2026-07-27_a735906e6c27da3ade99fe957342b6f3_amadey_cobalt-strike_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_medusalocker_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-27_a735906e6c27da3ade99fe957342b6f3_amadey_cobalt-strike_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_medusalocker_njrat
Size 989KB
Sample260727-xe2awsck61
SHA256 e2f446d209d3547ac52140eac0cb69cadf0db7a25d93ca9967122caac2779da0
MD5 a735906e6c27da3ade99fe957342b6f3
SHA1 8fc148397fe30f5175f7c58ae126337a414189cc
SHA512 4efbf8f38862fb327144e5a67cd597539b4608265b552f9691e6a1761bf9a10c097078639312ffb4c96aad3722c2c32f12887a5d51366bd2b89bedc3fb80d658
SSDEEP 24576:JrggoAMPI9b322jq7pO8zwompCoKJC3uF1gvL5BskTh7Bc4W6rEH7b:JrgLajqlO8ixKJccqTw4WF
TLSH
T1C3259E113381C5BAFF6282332A54E31582FEF9A40963861F2794777C7F391A25B3D692
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-27_a735906e6c27da3ade99fe957342b6f3_amadey_cobalt-strike_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_medusalocker_njrat

File Explorer

2026-07-27_a735906e6c27da3ade99fe957342b6f3_amadey_cobalt-strike_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_medusalocker_njrat

.exe 989KB

2026-07-27_a735906e6c27da3ade99fe957342b6f3_amadey_cobalt-strike_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_medusalocker_njrat

IMPHASH b1d04b1ebe040659866be4feed8055ce
SHA256 e2f446d209d3547ac52140eac0cb69cadf0db7a25d93ca9967122caac2779da0
MD5 a735906e6c27da3ade99fe957342b6f3
SHA1 8fc148397fe30f5175f7c58ae126337a414189cc
SHA512 4efbf8f38862fb327144e5a67cd597539b4608265b552f9691e6a1761bf9a10c097078639312ffb4c96aad3722c2c32f12887a5d51366bd2b89bedc3fb80d658
SSDEEP 24576:JrggoAMPI9b322jq7pO8zwompCoKJC3uF1gvL5BskTh7Bc4W6rEH7b:JrgLajqlO8ixKJccqTw4WF
TLSH
T1C3259E113381C5BAFF6282332A54E31582FEF9A40963861F2794777C7F391A25B3D692
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

45:e3:3a:37:13:d2:0f:25:b4:52:46:24:6f:76:11:60:27:3c:a9:e4:3d:ad:78:29:b8:51:ef:51:c4:63:93:d0

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=91540195754285145H,CN=Wondershare Technology Group Co.\,Ltd,O=Wondershare Technology Group Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c0fe8a5bfe8978fe887aae6b2bbe58cba,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Aug 29, 2022

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

4f:f6:13:48:ad:4a:db:ca:e7:07:54:ea:b1:8c:07:d2:05:fc:16:ff

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

Chains

Aug 29, 2022

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 29, 2022 - Mar 14, 2033

Subject

Serial Number

05:99:17:fd:77:18:80:8b:c3:4b:e2:24:e4:15:21:6f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 8, 2022 - Apr 5, 2025

Minor OS version

Major OS version

Entry point

202347

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

iphlpapi

GetAdaptersInfo

kernel32

GetFileAttributesW GetFileAttributesExW RemoveDirectoryW SetFilePointer Sleep MoveFileExW GetEnvironmentVariableW SetEnvironmentVariableW GetSystemInfo GetVersionExW GetComputerNameW EnterCriticalSection LeaveCriticalSection FindClose FindFirstFileW FindNextFileW ResetEvent WaitForMultipleObjects InitializeCriticalSectionAndSpinCount TryEnterCriticalSection DeleteCriticalSection GetModuleFileNameW SetConsoleCtrlHandler FreeLibrary GetProcAddress LoadLibraryW VerSetConditionMask SetLastError CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus DeleteFileW QueueUserAPC TerminateThread TlsAlloc TlsGetValue TlsSetValue TlsFree FormatMessageA VerifyVersionInfoA MultiByteToWideChar FormatMessageW LocalFree WideCharToMultiByte GetSystemDirectoryW GetTempPathW GetLongPathNameW GetCurrentDirectoryW WriteFile ReadFile CreateEventW SetEvent GetStartupInfoW TerminateProcess GetCurrentProcessId DuplicateHandle GetStdHandle GetSystemTimeAsFileTime WTSGetActiveConsoleSessionId OpenProcess GetCurrentThread GetExitCodeProcess GetCurrentProcess WaitForSingleObject GetLastError CloseHandle SetWaitableTimer CreateFileW SetConsoleTextAttribute GetConsoleScreenBufferInfo WriteConsoleW HeapSize GetProcessHeap SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetTimeZoneInformation ReadConsoleW FlushFileBuffers GetConsoleMode GetConsoleCP SetFilePointerEx GetFileSizeEx HeapReAlloc QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx SwitchToThread GetCurrentThreadId GetExitCodeThread GetTickCount GetModuleHandleW EncodePointer DecodePointer CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW VirtualAlloc VirtualProtect VirtualFree ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx RaiseException RtlUnwind ExitThread GetModuleHandleExW ExitProcess GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType IsValidLocale GetUserDefaultLCID EnumSystemLocalesW

ole32

CoImpersonateClient

advapi32

RegOpenKeyExW ReportEventW RegisterEventSourceW RegSetValueExW RegCreateKeyExW RegCloseKey OpenServiceW OpenSCManagerW DeleteService CreateServiceW CloseServiceHandle ChangeServiceConfigW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW SetTokenInformation GetTokenInformation DuplicateTokenEx CreateProcessAsUserA OpenThreadToken OpenProcessToken DeregisterEventSource

ws2_32

WSASocketW WSASend WSAGetLastError WSASetLastError WSACleanup WSAStartup shutdown listen htons ioctlsocket closesocket bind WSARecv setsockopt

mswsock

AcceptEx GetAcceptExSockaddrs

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-27_a735906e6c27da3ade99fe957342b6f3_amadey_cobalt-strike_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_medusalocker_njrat

PE Signature issue

PE Signature issue

userenv

iphlpapi

kernel32

ole32

advapi32

ws2_32

mswsock

generic