2026-08-01_dd04908bdc5c0cb251d7c8e0b6b1afb1_amadey_cobalt-strike_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_dd04908bdc5c0cb251d7c8e0b6b1afb1_amadey_cobalt-strike_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_njrat_smoke-loader
Size 881KB
Sample260802-efxpzstfne
SHA256 4b57f22298adb64d66c475950a9311577df11e88f6f0d89471e053fc9d158a95
MD5 dd04908bdc5c0cb251d7c8e0b6b1afb1
SHA1 18a94abeffe49d299797ec58ca8e54b815291627
SHA512 e55ac59bb07e2d12378d485c041488a0b5b86ef7d6a68edbec85afcff43bd30349a0b1ab24bb8bd799e6b5be73e0e82dc02b639b9235cbd32c71ef483a567e46
SSDEEP 24576:Q7l8t7IRGaBqgs9MaHaCeY3IcotVshrEH7tD:QTHAbCateY3IcCVXD
TLSH
T13615B0217481C0B6E2710031696CEB6A55BDB6780F6975DB73D80BAD8E282C21F35F9F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-01_dd04908bdc5c0cb251d7c8e0b6b1afb1_amadey_cobalt-strike_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_njrat_smoke-loader

File Explorer

2026-08-01_dd04908bdc5c0cb251d7c8e0b6b1afb1_amadey_cobalt-strike_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_njrat_smoke-loader

.exe 881KB

2026-08-01_dd04908bdc5c0cb251d7c8e0b6b1afb1_amadey_cobalt-strike_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_njrat_smoke-loader

IMPHASH cabc6e1e02ea348e5ffb0b58a8385255
SHA256 4b57f22298adb64d66c475950a9311577df11e88f6f0d89471e053fc9d158a95
MD5 dd04908bdc5c0cb251d7c8e0b6b1afb1
SHA1 18a94abeffe49d299797ec58ca8e54b815291627
SHA512 e55ac59bb07e2d12378d485c041488a0b5b86ef7d6a68edbec85afcff43bd30349a0b1ab24bb8bd799e6b5be73e0e82dc02b639b9235cbd32c71ef483a567e46
SSDEEP 24576:Q7l8t7IRGaBqgs9MaHaCeY3IcotVshrEH7tD:QTHAbCateY3IcCVXD
TLSH
T13615B0217481C0B6E2710031696CEB6A55BDB6780F6975DB73D80BAD8E282C21F35F9F
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

e0:e0:66:5e:6a:b1:a8:98:b6:48:03:07:a5:32:9c:72:ab:d2:2c:3f:d0:c0:34:a7:82:d6:5a:22:ce:c3:0c:41

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=110111-5300647,CN=KSign Co.\,Ltd.,O=KSign Co.\,Ltd.,L=Gangnam-gu,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130553656f756c,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Chains

Jan 29, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

49:0f:2b:0a:5f:c0:49:dd:df:18:7d:a6:23:f3:62:12:89:4c:02:21

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

Chains

Jan 29, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

Serial Number

05:64:7b:e3:0e:83:5d:2e:59:0b:5d:a4:4b:36:44:f9

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 25, 2023 - Nov 16, 2026

Minor OS version

Major OS version

Entry point

414005

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\HTML5\KCaseAgent-For-HTML5\Release\KCaseAgent.pdb

libssl-1_1

SSL_write SSL_CTX_set_default_passwd_cb_userdata SSL_ctrl SSL_get_ex_data SSL_accept SSL_read SSL_CTX_use_certificate_chain_file SSL_CTX_ctrl SSL_CTX_free SSL_set_ex_data SSL_new SSL_CTX_set_options SSL_free TLS_method SSL_CTX_set_default_passwd_cb SSL_connect SSL_get_shutdown SSL_CTX_new SSL_CTX_use_PrivateKey_file SSL_set_bio SSL_CTX_get_ex_data SSL_get_error SSL_CTX_set_ex_data SSL_shutdown SSL_CTX_get_default_passwd_cb_userdata

libcrypto-1_1

ERR_lib_error_string ERR_reason_error_string ERR_clear_error BIO_free CONF_modules_unload BIO_ctrl_pending BIO_new_bio_pair ERR_get_error BIO_read BIO_ctrl BIO_write ERR_func_error_string

kernel32

GetSystemDefaultUILanguage GetUserDefaultUILanguage GlobalFlags DeleteFileA FileTimeToSystemTime GetOEMCP GetCPInfo FindClose FindFirstFileA GetFullPathNameA SetEndOfFile GetVolumeInformationA FileTimeToLocalFileTime GetFileAttributesExA GetFileSizeEx SystemTimeToTzSpecificLocalTime GetUserDefaultLCID ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter WritePrivateProfileStringA IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead GetPrivateProfileStringA GetPrivateProfileIntA LocalReAlloc LocalAlloc GlobalHandle GlobalReAlloc InitializeCriticalSection GetLocaleInfoW GlobalGetAtomNameA GlobalFindAtomA GlobalAddAtomA lstrcmpW LoadLibraryA GetSystemDirectoryW EncodePointer SetErrorMode InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryEnterCriticalSection QueryPerformanceFrequency GlobalFree GlobalUnlock CompareStringA lstrcmpA GlobalDeleteAtom GlobalLock GlobalAlloc LoadLibraryExW FreeLibrary GetCurrentThreadId GetCurrentThread LoadLibraryW GetProcAddress GetModuleHandleW GetModuleFileNameW GetACP CreateIoCompletionPort GetSystemTimeAsFileTime TlsGetValue SleepEx VerSetConditionMask CreateWaitableTimerA QueueUserAPC CreateEventW GetQueuedCompletionStatus InitializeCriticalSectionAndSpinCount WaitForMultipleObjects SetLastError VerifyVersionInfoA TlsSetValue SetWaitableTimer TerminateThread CreateEventA SetEvent TerminateProcess Sleep GetModuleFileNameA FlushFileBuffers LCMapStringEx ConnectNamedPipe WriteFile CreateNamedPipeA ReadFile GetCurrentProcessId OutputDebugStringW OutputDebugStringA ReleaseMutex WaitForSingleObject CreateMutexA CreateThread CloseHandle Process32Next GetVersionExA ProcessIdToSessionId SetEnvironmentVariableW MultiByteToWideChar CreateToolhelp32Snapshot OpenProcess GetCurrentProcess Process32First FormatMessageA TlsFree WinExec GetConsoleWindow WideCharToMultiByte GetProcessHeap DeleteCriticalSection LocalFree DecodePointer HeapAlloc FindResourceW LoadResource RaiseException HeapReAlloc LockResource TlsAlloc GetLastError FormatMessageW GetCommandLineA PostQueuedCompletionStatus HeapSize GetModuleHandleA InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection HeapFree SizeofResource GetStringTypeW RtlUnwind GetConsoleCP ExitProcess GetModuleHandleExW GetConsoleMode ReadConsoleW CreateFileW GetFileType GetConsoleOutputCP ExitThread FreeLibraryAndExitThread GetStdHandle WriteConsoleW GetCommandLineW HeapQueryInformation GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW IsValidLocale EnumSystemLocalesW SetConsoleMode ReadConsoleInputW CreateDirectoryW SetStdHandle SetFilePointerEx GetTimeZoneInformation FindFirstFileExW FindNextFileW IsValidCodePage GetEnvironmentStringsW FreeEnvironmentStringsW SetUnhandledExceptionFilter

user32

TranslateMessage GetMessageA LoadBitmapW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem SetWindowTextA IsWindowEnabled ShowWindow GetMonitorInfoA MonitorFromWindow WinHelpA LoadIconW LoadIconA CallNextHookEx UnhookWindowsHookEx SetWindowsHookExA GetActiveWindow GetTopWindow GetClassNameA GetClassLongA SetWindowLongA PtInRect CopyRect GetSysColor MapWindowPoints ScreenToClient MessageBoxA AdjustWindowRectEx GetWindowRect RemovePropA GetPropA GetDC RedrawWindow ValidateRect EndPaint BeginPaint SetForegroundWindow GetForegroundWindow UpdateWindow SetMenu GetMenu GetCursorPos SetCursor TabbedTextOutA ClientToScreen RealChildWindowFromPoint SetTimer KillTimer InvalidateRect DrawTextA DrawTextExA GrayStringA GetLastActivePopup EnableWindow GetCapture GetKeyState GetFocus GetDlgCtrlID GetDlgItem IsIconic IsWindowVisible EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetWindowPos DestroyWindow IsMenu IsWindow CreateWindowExA GetClassInfoExA GetClassInfoA RegisterClassA CallWindowProcA DefWindowProcA GetMessageTime GetMessagePos PeekMessageA DispatchMessageA RegisterWindowMessageA GetWindowLongA GetWindowTextA GetScrollPos ReleaseDC GetSystemMetrics GetSysColorBrush LoadCursorA DestroyMenu CharUpperA SetPropA SendMessageA GetMenuItemCount GetMenuItemID GetSubMenu PostQuitMessage PostMessageA OffsetRect SetRectEmpty GetClientRect GetWindowThreadProcessId GetWindow GetParent SetMenuItemInfoA

gdi32

TextOutA ExtTextOutA SetViewportExtEx SetViewportOrgEx SetWindowExtEx ScaleViewportExtEx ScaleWindowExtEx SetMapMode SelectObject SaveDC RestoreDC RectVisible PtVisible GetStockObject GetClipBox Escape DeleteDC GetDeviceCaps SetBkColor SetTextColor CreateBitmap DeleteObject OffsetViewportOrgEx

winspool.drv

DocumentPropertiesA OpenPrinterA ClosePrinter

advapi32

CreateServiceA CheckTokenMembership OpenProcessToken GetUserNameA CreateWellKnownSid RegSetValueExA RegEnumValueA RegQueryValueA RegEnumKeyA RegDeleteValueA RegOpenKeyExA AdjustTokenPrivileges CreateProcessAsUserA SetTokenInformation LookupPrivilegeValueA DuplicateTokenEx GetTokenInformation StartServiceCtrlDispatcherA CloseServiceHandle SetServiceStatus OpenSCManagerA RegisterServiceCtrlHandlerExA DeleteService ControlService StartServiceA OpenServiceA SetSecurityDescriptorDacl InitializeSecurityDescriptor RegCloseKey RegDeleteKeyA RegQueryValueExA RegCreateKeyExA

shell32

ord680 SHGetSpecialFolderPathA

shlwapi

PathIsUNCA PathStripToRootA PathFindFileNameA PathFindExtensionA

ole32

CoInitialize CoCreateInstance CoUninitialize CoCreateGuid CoTaskMemFree

oleaut32

VariantChangeType VariantClear VariantInit SysAllocStringLen SysFreeString

ws2_32

WSARecv htonl ioctlsocket setsockopt WSAGetLastError bind WSASocketW ntohl WSAStringToAddressW inet_addr htons WSACleanup WSAStartup WSASetLastError shutdown listen select closesocket WSASend accept

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

httpapi

HttpSendResponseEntityBody HttpSendHttpResponse HttpReceiveRequestEntityBody HttpSetServiceConfiguration HttpAddUrl HttpTerminate HttpRemoveUrl HttpInitialize HttpCreateHttpHandle HttpReceiveHttpRequest HttpDeleteServiceConfiguration

wtsapi32

WTSFreeMemory WTSQueryUserToken WTSEnumerateSessionsA

crypt32

CertGetCertificateContextProperty CertOpenStore CertFindCertificateInStore CertCloseStore CertDeleteCertificateFromStore CertFreeCertificateContext

cryptui

CryptUIWizImport

oleacc

CreateStdAccessibleObject LresultFromObject

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_dd04908bdc5c0cb251d7c8e0b6b1afb1_amadey_cobalt-strike_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_njrat_smoke-loader

PE Signature issue

PE Signature issue

libssl-1_1

libcrypto-1_1

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

shlwapi

ole32

oleaut32

ws2_32

userenv

httpapi

wtsapi32

crypt32

cryptui

oleacc

generic