2026-08-01_9b2b6dc8c8f4c72babd3601ca347cff1_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_9b2b6dc8c8f4c72babd3601ca347cff1_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat
Size 467KB
Sample260802-emccmatgpe
SHA256 8b0a77f46a04817b2c0c78d59041692f55d92365771f7e00e4df5e49c236ff79
MD5 9b2b6dc8c8f4c72babd3601ca347cff1
SHA1 42c86c2389f0e4a53c6662843e21d90ddb02c4ef
SHA512 d23a6d0b7a52d496eb177a4bb6dc1b22a64b8262b0913908c6b976bc48104b1e1fa2168dacc8005ab5f7149e1891d8dcbb9416d85d06c3a93f10a00fc07866d1
SSDEEP 12288:StzPQdquSvex1mIozahj0KjW7NFn2FRLe9i:StzPQVoze0KjW7NUF49i
TLSH
T1AAA4AE2235B1C032D5A281315E39EFA6627DFD304F6249CBB3D42A6E6F706C19B35B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_9b2b6dc8c8f4c72babd3601ca347cff1_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

File Explorer

2026-08-01_9b2b6dc8c8f4c72babd3601ca347cff1_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

.exe 467KB

2026-08-01_9b2b6dc8c8f4c72babd3601ca347cff1_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

IMPHASH 23b0accb99d601ea166b8ce3b13b44bd
SHA256 8b0a77f46a04817b2c0c78d59041692f55d92365771f7e00e4df5e49c236ff79
MD5 9b2b6dc8c8f4c72babd3601ca347cff1
SHA1 42c86c2389f0e4a53c6662843e21d90ddb02c4ef
SHA512 d23a6d0b7a52d496eb177a4bb6dc1b22a64b8262b0913908c6b976bc48104b1e1fa2168dacc8005ab5f7149e1891d8dcbb9416d85d06c3a93f10a00fc07866d1
SSDEEP 12288:StzPQdquSvex1mIozahj0KjW7NFn2FRLe9i:StzPQVoze0KjW7NUF49i
TLSH
T1AAA4AE2235B1C032D5A281315E39EFA6627DFD304F6249CBB3D42A6E6F706C19B35B16
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

208437

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

rpcrt4

RpcServerInqCallAttributesW NdrCStdStubBuffer2_Release NdrStubForwardingFunction IUnknown_Release_Proxy NdrOleFree NdrStubCall2 IUnknown_AddRef_Proxy IUnknown_QueryInterface_Proxy NdrOleAllocate

kernel32

CreateThread GetCurrentThread GetCurrentThreadId GetVersionExW LocalAlloc LocalFree GetLocalTime OpenProcess QueryFullProcessImageNameW CreateDirectoryW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetShortPathNameW RemoveDirectoryW CopyFileW MoveFileExW ProcessIdToSessionId FindResourceExW LockResource CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateTimerQueue CreateTimerQueueTimer DeleteTimerQueueTimer DeleteTimerQueueEx OpenMutexW GetCurrentProcessId CreateProcessW GetTickCount GetWindowsDirectoryW WritePrivateProfileStringW CreateFileW ReadFile GetOEMCP GetACP IsValidCodePage FindFirstFileExW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetCurrentProcess GetDateFormatW GetTimeZoneInformation GetFileSizeEx ReadConsoleW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType WriteFile GetStdHandle ExitProcess GetModuleHandleExW TlsFree TlsSetValue TlsGetValue TlsAlloc GetSystemTimeAsFileTime SleepConditionVariableSRW WakeAllConditionVariable InitializeCriticalSectionAndSpinCount Sleep CreateEventW CreateMutexW WaitForSingleObject SetEvent RaiseException CloseHandle OutputDebugStringW GetCommandLineW MultiByteToWideChar lstrcmpiW FindResourceW SizeofResource LoadResource LoadLibraryExW GetProcAddress AcquireSRWLockExclusive GetModuleHandleW GetModuleFileNameW FreeLibrary DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError DecodePointer GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle SetEndOfFile WriteConsoleW SetLastError RtlUnwind InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent GetCPInfo CompareStringEx GetTimeFormatW GetStringTypeW WideCharToMultiByte InitOnceBeginInitialize InitOnceComplete QueryPerformanceCounter GetLocaleInfoEx EncodePointer LCMapStringEx ReleaseSRWLockExclusive

user32

DispatchMessageW MessageBoxW PostThreadMessageW CharUpperW TranslateMessage LoadStringW CharNextW GetMessageW

shell32

SHGetSpecialFolderPathW SHCreateDirectoryExW ShellExecuteW ord680 SHGetPathFromIDListW SHGetSpecialFolderLocation

ole32

CoUninitialize CoInitializeEx CoRegisterClassObject CoRevokeClassObject CoResumeClassObjects CoTaskMemFree CoReleaseServerProcess CoInitializeSecurity CoCreateInstance StringFromGUID2 CoCreateGuid CoAddRefServerProcess CoTaskMemAlloc CoTaskMemRealloc

oleaut32

BSTR_UserUnmarshal BSTR_UserMarshal BSTR_UserSize UnRegisterTypeLi RegisterTypeLi BSTR_UserFree LoadRegTypeLi LoadTypeLi VarUI4FromStr SysStringLen SysFreeString SysAllocString VariantClear

advapi32

InitializeSecurityDescriptor RegCreateKeyExW RegDeleteKeyW SetTokenInformation RevertToSelf ImpersonateLoggedOnUser DuplicateTokenEx CreateProcessAsUserW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle RegQueryValueExW ReportEventW RegisterEventSourceW DeregisterEventSource SetSecurityDescriptorSacl SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl IsValidSid InitializeAcl GetTokenInformation GetSecurityDescriptorSacl GetLengthSid CopySid AddAccessAllowedAce OpenThreadToken OpenProcessToken RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegCloseKey

shlwapi

PathFileExistsW PathFindFileNameW PathAppendW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

crypt32

CertGetNameStringW

wintrust

WTHelperGetProvSignerFromChain WTHelperGetProvCertFromChain WTHelperProvDataFromStateData WinVerifyTrust

Name

.text

Size

359KB

Virtual Size

358KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.orpc

Size

512B

Virtual Size

69B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

76KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_9b2b6dc8c8f4c72babd3601ca347cff1_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

rpcrt4

kernel32

user32

shell32

ole32

oleaut32

advapi32

shlwapi

version

wtsapi32

userenv

crypt32

wintrust

generic