2026-07-19_49eeff5e9fcaaad557994910c551806d_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-19_49eeff5e9fcaaad557994910c551806d_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat
Size 453KB
Sample260720-bye14sbw8l
SHA256 969f081b0d392b124d4480dd0b80819eaf60d65f96d5574c5795b387acd3a76d
MD5 49eeff5e9fcaaad557994910c551806d
SHA1 8afd361d13da4a8197b40f58e6c89719c877d6a5
SHA512 3ec8350c526f6af5db891beec636065ad363c71dc076abf7f7f0ff9e75dea512b37747cc7ddbf1278d89f593b6c4f2031a284d4b081a073d9e1722063e790a88
SSDEEP 6144:YQHCBEYL802ubLbw04hkujkjNaiL+1r2wU30Ghn5sErcNs7PuBr7foZl7PSz595b:Y/BEy7bDh0kjNae+IhsSq1fo77Kz5T
TLSH
T19AA4F151B5E0C072D9B7183148F4EBB56D7EBC300F20AAAB63844B7A9E345D1C725B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-19_49eeff5e9fcaaad557994910c551806d_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

File Explorer

2026-07-19_49eeff5e9fcaaad557994910c551806d_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

.exe 453KB

2026-07-19_49eeff5e9fcaaad557994910c551806d_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

IMPHASH a5272d1ccdd85777b7e23ded3227f165
SHA256 969f081b0d392b124d4480dd0b80819eaf60d65f96d5574c5795b387acd3a76d
MD5 49eeff5e9fcaaad557994910c551806d
SHA1 8afd361d13da4a8197b40f58e6c89719c877d6a5
SHA512 3ec8350c526f6af5db891beec636065ad363c71dc076abf7f7f0ff9e75dea512b37747cc7ddbf1278d89f593b6c4f2031a284d4b081a073d9e1722063e790a88
SSDEEP 6144:YQHCBEYL802ubLbw04hkujkjNaiL+1r2wU30Ghn5sErcNs7PuBr7foZl7PSz595b:Y/BEy7bDh0kjNae+IhsSq1fo77Kz5T
TLSH
T19AA4F151B5E0C072D9B7183148F4EBB56D7EBC300F20AAAB63844B7A9E345D1C725B6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14770

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateMutexA GetVolumeInformationA WaitForSingleObject GetModuleHandleA OpenProcess CreateToolhelp32Snapshot Sleep CopyFileA GetLastError GetFileAttributesA CreateFileA GetSystemDirectoryA DeleteFileA Process32Next CloseHandle GetSystemInfo CreateThread SetFileAttributesA SetFilePointer GetProcAddress WTSGetActiveConsoleSessionId GetFileSize ExitProcess GetCurrentProcessId CreateProcessA CreateDirectoryA GetTickCount GetComputerNameA VerSetConditionMask VerifyVersionInfoW CreateFileW DecodePointer GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize WriteFile GetCurrentProcess Process32First GetModuleFileNameA GetSystemWow64DirectoryA ReadFile SetFilePointerEx GetProcessHeap GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RaiseException RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer GetStdHandle GetModuleFileNameW GetModuleHandleExW HeapAlloc HeapFree LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WriteConsoleW

user32

TranslateMessage CreateWindowExA ShowWindow GetMessageA DispatchMessageA DestroyWindow

advapi32

FreeSid CheckTokenMembership GetUserNameA OpenProcessToken AllocateAndInitializeSid

shell32

SHGetSpecialFolderPathA SHGetFolderPathA ShellExecuteExA

shlwapi

StrStrIA

userenv

GetUserProfileDirectoryA

wtsapi32

WTSQueryUserToken

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-19_49eeff5e9fcaaad557994910c551806d_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

kernel32

user32

advapi32

shell32

shlwapi

userenv

wtsapi32

generic