2026-08-01_f3007c5624396033a9c985bf653ed713_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_f3007c5624396033a9c985bf653ed713_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat
Size 467KB
Sample260802-ec4n5asxes
SHA256 ca116b4e76a70676c64287880103e853a45b6bdaf6f96809b8aaf47fb7c35c9b
MD5 f3007c5624396033a9c985bf653ed713
SHA1 f8b704be72e9b03aceb32ab7029f60f24eb100ef
SHA512 6918d49f4f164d5da2b053f91e12530e5869e9dafb408f65b634a6c61cec299c3da38173ee61d1ec04eae5d88f2160684da602ea983b22dc43a104dae2c1f34d
SSDEEP 12288:mtzPQdquSvex1mIozahj0KjW7NFn2FRLeJi:mtzPQVoze0KjW7NUF4Ji
TLSH
T145A4AE2235B1C032D5A281315E39EFA6627DFD304F6249CBB3D42A6E6F706C19B35B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_f3007c5624396033a9c985bf653ed713_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

File Explorer

2026-08-01_f3007c5624396033a9c985bf653ed713_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

.exe 467KB

2026-08-01_f3007c5624396033a9c985bf653ed713_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

IMPHASH 23b0accb99d601ea166b8ce3b13b44bd
SHA256 ca116b4e76a70676c64287880103e853a45b6bdaf6f96809b8aaf47fb7c35c9b
MD5 f3007c5624396033a9c985bf653ed713
SHA1 f8b704be72e9b03aceb32ab7029f60f24eb100ef
SHA512 6918d49f4f164d5da2b053f91e12530e5869e9dafb408f65b634a6c61cec299c3da38173ee61d1ec04eae5d88f2160684da602ea983b22dc43a104dae2c1f34d
SSDEEP 12288:mtzPQdquSvex1mIozahj0KjW7NFn2FRLeJi:mtzPQVoze0KjW7NUF4Ji
TLSH
T145A4AE2235B1C032D5A281315E39EFA6627DFD304F6249CBB3D42A6E6F706C19B35B16
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

208437

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

rpcrt4

RpcServerInqCallAttributesW NdrCStdStubBuffer2_Release NdrStubForwardingFunction IUnknown_Release_Proxy NdrOleFree NdrStubCall2 IUnknown_AddRef_Proxy IUnknown_QueryInterface_Proxy NdrOleAllocate

kernel32

CreateThread GetCurrentThread GetCurrentThreadId GetVersionExW LocalAlloc LocalFree GetLocalTime OpenProcess QueryFullProcessImageNameW CreateDirectoryW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetShortPathNameW RemoveDirectoryW CopyFileW MoveFileExW ProcessIdToSessionId FindResourceExW LockResource CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateTimerQueue CreateTimerQueueTimer DeleteTimerQueueTimer DeleteTimerQueueEx OpenMutexW GetCurrentProcessId CreateProcessW GetTickCount GetWindowsDirectoryW WritePrivateProfileStringW CreateFileW ReadFile GetOEMCP GetACP IsValidCodePage FindFirstFileExW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetCurrentProcess GetDateFormatW GetTimeZoneInformation GetFileSizeEx ReadConsoleW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType WriteFile GetStdHandle ExitProcess GetModuleHandleExW TlsFree TlsSetValue TlsGetValue TlsAlloc GetSystemTimeAsFileTime SleepConditionVariableSRW WakeAllConditionVariable InitializeCriticalSectionAndSpinCount Sleep CreateEventW CreateMutexW WaitForSingleObject SetEvent RaiseException CloseHandle OutputDebugStringW GetCommandLineW MultiByteToWideChar lstrcmpiW FindResourceW SizeofResource LoadResource LoadLibraryExW GetProcAddress AcquireSRWLockExclusive GetModuleHandleW GetModuleFileNameW FreeLibrary DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError DecodePointer GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle SetEndOfFile WriteConsoleW SetLastError RtlUnwind InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent GetCPInfo CompareStringEx GetTimeFormatW GetStringTypeW WideCharToMultiByte InitOnceBeginInitialize InitOnceComplete QueryPerformanceCounter GetLocaleInfoEx EncodePointer LCMapStringEx ReleaseSRWLockExclusive

user32

DispatchMessageW MessageBoxW PostThreadMessageW CharUpperW TranslateMessage LoadStringW CharNextW GetMessageW

shell32

SHGetSpecialFolderPathW SHCreateDirectoryExW ShellExecuteW ord680 SHGetPathFromIDListW SHGetSpecialFolderLocation

ole32

CoUninitialize CoInitializeEx CoRegisterClassObject CoRevokeClassObject CoResumeClassObjects CoTaskMemFree CoReleaseServerProcess CoInitializeSecurity CoCreateInstance StringFromGUID2 CoCreateGuid CoAddRefServerProcess CoTaskMemAlloc CoTaskMemRealloc

oleaut32

BSTR_UserUnmarshal BSTR_UserMarshal BSTR_UserSize UnRegisterTypeLi RegisterTypeLi BSTR_UserFree LoadRegTypeLi LoadTypeLi VarUI4FromStr SysStringLen SysFreeString SysAllocString VariantClear

advapi32

InitializeSecurityDescriptor RegCreateKeyExW RegDeleteKeyW SetTokenInformation RevertToSelf ImpersonateLoggedOnUser DuplicateTokenEx CreateProcessAsUserW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle RegQueryValueExW ReportEventW RegisterEventSourceW DeregisterEventSource SetSecurityDescriptorSacl SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl IsValidSid InitializeAcl GetTokenInformation GetSecurityDescriptorSacl GetLengthSid CopySid AddAccessAllowedAce OpenThreadToken OpenProcessToken RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegCloseKey

shlwapi

PathFileExistsW PathFindFileNameW PathAppendW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

crypt32

CertGetNameStringW

wintrust

WTHelperGetProvSignerFromChain WTHelperGetProvCertFromChain WTHelperProvDataFromStateData WinVerifyTrust

Name

.text

Size

359KB

Virtual Size

358KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.orpc

Size

512B

Virtual Size

69B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

76KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_f3007c5624396033a9c985bf653ed713_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

rpcrt4

kernel32

user32

shell32

ole32

oleaut32

advapi32

shlwapi

version

wtsapi32

userenv

crypt32

wintrust

generic