2026-07-22_e83152102f69bf9b2c0df80235752f74_amadey_cobalt-strike_elex_luca-stealer_magniber_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_e83152102f69bf9b2c0df80235752f74_amadey_cobalt-strike_elex_luca-stealer_magniber_njrat
Size 406KB
Sample260722-ssvcaage64
SHA256 7f1f955e29c22d5b322c3d8c12ff9ef67b3d2b6980aeb8ac4efbf8986d59cea1
MD5 e83152102f69bf9b2c0df80235752f74
SHA1 b2b67e0c27a438b9dd5644d879af281e19c91427
SHA512 9676a8ec9ef7319182bd65d167965cf5e2a01457960b4391a7d68cfe9db0fac451e5cdffea5f0730b4638837dceb03556b0ac2897170675ac0d8129445a7bcd4
SSDEEP 6144:OUKv/1NxkfblXozbXxiIPnZ51eAO1lWqn7ADRsIRqwORTyfvQ9nh9nzq:OUW8RozQ4nkIqnc1sIRqofvinu
TLSH
T11094D003F2C394B3DA7214310675ABB6AA7EA6700A314DBB37E41D1A1F742D1A631B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-22_e83152102f69bf9b2c0df80235752f74_amadey_cobalt-strike_elex_luca-stealer_magniber_njrat

.exe 406KB

2026-07-22_e83152102f69bf9b2c0df80235752f74_amadey_cobalt-strike_elex_luca-stealer_magniber_njrat

IMPHASH 68582d77b772373da02394826519a2b9
SHA256 7f1f955e29c22d5b322c3d8c12ff9ef67b3d2b6980aeb8ac4efbf8986d59cea1
MD5 e83152102f69bf9b2c0df80235752f74
SHA1 b2b67e0c27a438b9dd5644d879af281e19c91427
SHA512 9676a8ec9ef7319182bd65d167965cf5e2a01457960b4391a7d68cfe9db0fac451e5cdffea5f0730b4638837dceb03556b0ac2897170675ac0d8129445a7bcd4
SSDEEP 6144:OUKv/1NxkfblXozbXxiIPnZ51eAO1lWqn7ADRsIRqwORTyfvQ9nh9nzq:OUW8RozQ4nkIqnc1sIRqofvinu
TLSH
T11094D003F2C394B3DA7214310675ABB6AA7EA6700A314DBB37E41D1A1F742D1A631B77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

cc:0e:b9:6d:bd:35:1f:df:47:d3:a3:8d:2f:42:47:1f:fb:0c:86:ad:42:09:5f:eb:d0:96:9f:28:fd:bd:f7:2c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Gammadyne Corporation,O=Gammadyne Corporation,ST=Kansas,C=US

Chains

Jan 20, 2024

CN=Gammadyne Corporation,O=Gammadyne Corporation,ST=Kansas,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Gammadyne Corporation,O=Gammadyne Corporation,ST=Kansas,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Digest

52:61:07:65:75:45:76:8e:a7:0b:1d:0b:5d:d3:53:e9:63:a1:b0:35

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Gammadyne Corporation,O=Gammadyne Corporation,ST=Kansas,C=US

Chains

Jan 20, 2024

CN=Gammadyne Corporation,O=Gammadyne Corporation,ST=Kansas,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Gammadyne Corporation,O=Gammadyne Corporation,ST=Kansas,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Gammadyne Corporation,O=Gammadyne Corporation,ST=Kansas,C=US

Serial Number

10:1f:3e:54:c0:2f:72:13:50:0f:71:6c:53:e3:02:bf

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 18, 2022 - Oct 17, 2025

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 3, 2023 - Aug 2, 2034

Minor OS version

Major OS version

Entry point

77515

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetCommandLineA GetCommandLineW SetEnvironmentVariableA ExpandEnvironmentStringsW IsValidCodePage GetACP GetOEMCP GetLocaleInfoA DecodePointer RaiseException DeleteCriticalSection LocalAlloc GetCurrentThreadId SetLastError InitializeCriticalSection EnterCriticalSection LeaveCriticalSection LoadLibraryA GetVersion LCMapStringA GetStringTypeA GetFileSize CompareStringA lstrcmpA lstrlenA GetFileAttributesA SetFilePointerEx SetStdHandle GetCPInfo FindNextFileA FindFirstFileExA GetConsoleCP GetFileType HeapAlloc HeapReAlloc HeapFree GetModuleHandleExW TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer RtlUnwind InterlockedPushEntrySList OutputDebugStringW GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter CreateEventW WaitForSingleObjectEx ResetEvent SetEvent InitializeSListHead GetLastError FreeEnvironmentStringsW GetEnvironmentStringsW TerminateProcess ExitProcess GetCurrentProcessId GetCurrentProcess GetProcessHeap HeapSize LocalFree FindNextFileW FindFirstFileW GetFileAttributesW CreateFileW CreateFileA GetCurrentDirectoryW SetCurrentDirectoryW CloseHandle GetFileTime FindClose FlushFileBuffers GetSystemDirectoryA GetModuleHandleA GetModuleFileNameA LoadLibraryExW LoadLibraryExA GetProcAddress FreeLibrary FileTimeToSystemTime SystemTimeToFileTime GetTimeZoneInformation GetLocalTime WriteConsoleW WriteConsoleA GetConsoleScreenBufferInfo GetConsoleMode WriteFile GetStdHandle Sleep

user32

CharLowerA CharUpperA

gdi32

DeleteObject

ole32

CoInitialize

shlwapi

PathCanonicalizeW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_e83152102f69bf9b2c0df80235752f74_amadey_cobalt-strike_elex_luca-stealer_magniber_njrat

kernel32

user32

gdi32

ole32

shlwapi

generic