2026-07-31_603df3f921e345a2ff0243856f006eb4_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader

General

Target
2026-07-31_603df3f921e345a2ff0243856f006eb4_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader
Size 216KB
Sample260731-btbswsaf55
SHA256 d032c4e83b88e853c64b6cc2a471881607076963a8558d2feaa9923854f90caa
MD5 603df3f921e345a2ff0243856f006eb4
SHA1 c7ce46954deaf250e83185463c308bb87dda63be
SHA512 f1917ceeda0e407c07f08171b69bda77af3a428c1f69e73801ee77a4dbb3dc60cc2044c1a865f654eac26a67b7dc49950dbad9cd5c7aad10dc3b27560863fcd8
SSDEEP 3072:+jWKxxaUAm+jSinWFFTnKQHkAx8JtOKbEJ67iy9rxddP6db71uoQdAg0Fuj0NmVK:2WB8snWFln2o8vFbEJ+9rxdhm+AOpMF
TLSH
T1B2247D10B5D2C473D572153509F4EBB9597EBD610F209AEFA3E80B7E8F302C29631A66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-31_603df3f921e345a2ff0243856f006eb4_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader

File Explorer

2026-07-31_603df3f921e345a2ff0243856f006eb4_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader

.exe 216KB

2026-07-31_603df3f921e345a2ff0243856f006eb4_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader

IMPHASH 334bc1656314fdf941b5750fa1832cbb
SHA256 d032c4e83b88e853c64b6cc2a471881607076963a8558d2feaa9923854f90caa
MD5 603df3f921e345a2ff0243856f006eb4
SHA1 c7ce46954deaf250e83185463c308bb87dda63be
SHA512 f1917ceeda0e407c07f08171b69bda77af3a428c1f69e73801ee77a4dbb3dc60cc2044c1a865f654eac26a67b7dc49950dbad9cd5c7aad10dc3b27560863fcd8
SSDEEP 3072:+jWKxxaUAm+jSinWFFTnKQHkAx8JtOKbEJ67iy9rxddP6db71uoQdAg0Fuj0NmVK:2WB8snWFln2o8vFbEJ+9rxdhm+AOpMF
TLSH
T1B2247D10B5D2C473D572153509F4EBB9597EBD610F209AEFA3E80B7E8F302C29631A66
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

29165

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\work\gitbase\whds3.0\plugin\CmdShellControl\Release\CmdShellControl.pdb

kernel32

HeapFree SetConsoleTitleA InitializeCriticalSectionEx HeapSize Sleep GetLastError HeapReAlloc RaiseException HeapAlloc DecodePointer DeleteCriticalSection GetProcessHeap ExitProcess CreateFileW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose ReadConsoleW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection GetCurrentThreadId CloseHandle QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress EncodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount CreateEventW IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead OutputDebugStringW RtlUnwind SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType WaitForSingleObject GetExitCodeProcess CreateProcessW GetFileAttributesExW GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile WriteConsoleW

ws2_32

connect send htons WSACleanup WSAStartup closesocket socket inet_addr recv

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-31_603df3f921e345a2ff0243856f006eb4_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader

kernel32

ws2_32

generic