2026-07-29_be11c1547f80845f644adc03a55be0bb_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-29_be11c1547f80845f644adc03a55be0bb_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat_remcos
Size 706KB
Sample260729-pbb8lavydv
SHA256 bf4a611a85b734db3f0b6eba69ce255fe61c62443815f5abef88fdb77247ef61
MD5 be11c1547f80845f644adc03a55be0bb
SHA1 7f7a880476c5596773b9e924088d3ec6c21692c3
SHA512 72708ed6939d88786d0757ec5202350e1d1de31230a7549b6cf354c4026a3cf71d57404dd1aaba251e5784bb0b6c04cb7f25e1eb9dcf6663beda9a76e7508a2a
SSDEEP 12288:7UkQVGxuZwQIfmD+VWS6RrCWozKXopTUeX5pA2kOswQkaxBjvrEH7Zj:7EVuuufmD+4rCDKXGlI2kUZavrEH7R
TLSH
T153F46C10AEEBC9FAC12B223FA8199D5204DEE3350B5791C7A7811D39B7A81D39D315E3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-29_be11c1547f80845f644adc03a55be0bb_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat_remcos

File Explorer

2026-07-29_be11c1547f80845f644adc03a55be0bb_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat_remcos

.exe 706KB

2026-07-29_be11c1547f80845f644adc03a55be0bb_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat_remcos

IMPHASH 6a1857088a24b493d3d2821a232cae8c
SHA256 bf4a611a85b734db3f0b6eba69ce255fe61c62443815f5abef88fdb77247ef61
MD5 be11c1547f80845f644adc03a55be0bb
SHA1 7f7a880476c5596773b9e924088d3ec6c21692c3
SHA512 72708ed6939d88786d0757ec5202350e1d1de31230a7549b6cf354c4026a3cf71d57404dd1aaba251e5784bb0b6c04cb7f25e1eb9dcf6663beda9a76e7508a2a
SSDEEP 12288:7UkQVGxuZwQIfmD+VWS6RrCWozKXopTUeX5pA2kOswQkaxBjvrEH7Zj:7EVuuufmD+4rCDKXGlI2kUZavrEH7R
TLSH
T153F46C10AEEBC9FAC12B223FA8199D5204DEE3350B5791C7A7811D39B7A81D39D315E3
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

26:b6:b2:39:be:4d:26:95:56:67:ef:8e:ee:cb:e1:14:80:47:c1:5b:7c:ff:f1:00:77:f9:3a:03:9b:b0:4a:b3

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=NVIDIA Corporation,OU=IT-MIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

Chains

Jun 9, 2021

CN=NVIDIA Corporation,OU=IT-MIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=NVIDIA Corporation,OU=IT-MIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

Serial Number

62:e7:45:e9:21:65:21:3c:97:1f:5c:49:0a:ea:12:a5

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 9, 2018 - Jul 9, 2021

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7c:1b:35:35:4a:e7:db:74:e7:41:5f:11:69:ca:6b:a8

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 22, 2014 - Jul 21, 2024

Minor OS version

Major OS version

Entry point

223056

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\dvs\p4\build\sw\rel\gfclient\rel_03_23\nodejs\launcher\winxp_x86_release\nvnodejslauncher.pdb

shell32

CommandLineToArgvW SHGetKnownFolderPath SHGetFolderPathW

shlwapi

PathRemoveFileSpecW

oleaut32

SysAllocString SysFreeString VariantClear VariantInit

ole32

CoInitialize CoCreateInstance CoTaskMemFree

kernel32

GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage CreateDirectoryW GetCommandLineW GetCurrentProcess WriteFile GetModuleFileNameW K32GetModuleFileNameExW InitializeCriticalSectionEx WaitForSingleObject CreateFileW GetFileAttributesW OpenEventW OpenProcess CreateToolhelp32Snapshot CreateEventW Sleep GetTickCount64 GetLastError Process32NextW SetEvent QueryPerformanceFrequency Process32FirstW CloseHandle SetCurrentDirectoryW LocalFree FreeEnvironmentStringsW GetCurrentProcessId CreateProcessW GetModuleHandleW SystemTimeToTzSpecificLocalTime GetSystemTime QueryPerformanceCounter GetProcAddress FreeLibrary ReadFile GetFileSizeEx RaiseException DecodePointer DeleteCriticalSection SetLastError GetFullPathNameW ExpandEnvironmentStringsW LocalAlloc lstrcmpA GetSystemDirectoryW OutputDebugStringW FileTimeToSystemTime VerSetConditionMask VerifyVersionInfoW lstrcmpW LoadLibraryExW GetTimeZoneInformation HeapReAlloc EnumSystemLocalesW GetProcessHeap SetStdHandle HeapSize FlushFileBuffers GetConsoleCP GetConsoleMode MoveFileExW MultiByteToWideChar WriteConsoleW FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW SetFilePointerEx WideCharToMultiByte FormatMessageW GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime EncodePointer CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentThreadId InitializeSListHead RtlUnwind SetEnvironmentVariableW ExitProcess GetModuleHandleExW GetStdHandle HeapAlloc HeapFree GetFileType GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID

advapi32

CloseServiceHandle OpenSCManagerW OpenProcessToken RegGetValueW QueryServiceConfigW OpenServiceW GetTokenInformation QueryServiceStatus

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-29_be11c1547f80845f644adc03a55be0bb_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat_remcos

PE Signature issue

shell32

shlwapi

oleaut32

ole32

kernel32

advapi32

generic