2026-08-04_e86cb8985ea40ea4888703b9d20face2_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_virut

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_e86cb8985ea40ea4888703b9d20face2_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_virut
Size 796KB
Sample260804-fpjp6add26
SHA256 2d5bd60e171abd0a8aa51e18b864c8583ebc20f2538cd69c8b888bd99009b868
MD5 e86cb8985ea40ea4888703b9d20face2
SHA1 7f7e9e6c95bf2474264c50b42bc0e55ae369189a
SHA512 d3a2a91f21fdf9bd6c5a42ec207c635440b99d3680c3b0db547ccf219e3171def1ede2a1f978cd8483da6c808be886891ee9142e1ac42d8d42fcd9b381145ad0
SSDEEP 12288:iDNlbyef4ynihult/QWgrKHE2vhSMXlJphh9d3y+tyN:iPyefhnhltoWgrQE2vhSMXl7ho+y
TLSH
T12705C03275B5C033D03282710898A7A5A6BEFA710F32069B73D4666D7F741C1AB36B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-04_e86cb8985ea40ea4888703b9d20face2_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_virut

File Explorer

2026-08-04_e86cb8985ea40ea4888703b9d20face2_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_virut

.exe 796KB

2026-08-04_e86cb8985ea40ea4888703b9d20face2_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_virut

IMPHASH 304d3f4083263197807c084759035490
SHA256 2d5bd60e171abd0a8aa51e18b864c8583ebc20f2538cd69c8b888bd99009b868
MD5 e86cb8985ea40ea4888703b9d20face2
SHA1 7f7e9e6c95bf2474264c50b42bc0e55ae369189a
SHA512 d3a2a91f21fdf9bd6c5a42ec207c635440b99d3680c3b0db547ccf219e3171def1ede2a1f978cd8483da6c808be886891ee9142e1ac42d8d42fcd9b381145ad0
SSDEEP 12288:iDNlbyef4ynihult/QWgrKHE2vhSMXlJphh9d3y+tyN:iPyefhnhltoWgrQE2vhSMXl7ho+y
TLSH
T12705C03275B5C033D03282710898A7A5A6BEFA710F32069B73D4666D7F741C1AB36B5B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

ed:c0:aa:e8:e4:6e:f8:d8:ac:f7:e2:10:ed:e6:a1:4d:a6:72:26:33:4e:a3:25:19:a9:e8:4d:1c:e8:b5:85:3a

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Chains

Jun 10, 2026

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Serial Number

01:ba:be:96:e5:0e:a2:5f:3f:0e:88:42:9a:74:a4:62

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 17, 2024 - Jun 19, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

824951

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\landun\workspace\p-ad0484fbdfe349d18f6d70b4084a70ba\src\product\win32\pdfext.pdb

shlwapi

PathRemoveFileSpecW PathFileExistsW

kernel32

SetEndOfFile InitializeCriticalSectionEx CreateFileW GetFileAttributesW HeapSize MultiByteToWideChar GetLastError LockResource HeapReAlloc CloseHandle RaiseException FindResourceExW LoadResource FindResourceW HeapAlloc DecodePointer HeapDestroy GetFileSize DeleteCriticalSection GetProcessHeap WideCharToMultiByte SetFilePointer LocalAlloc LocalFree FlushFileBuffers FindNextFileW GetModuleFileNameW FindClose GetCommandLineW WriteFile CompareFileTime GetFileAttributesExW WaitForSingleObject CreateEventW SetEvent GetModuleFileNameA CreateDirectoryA CreateMutexW ReleaseMutex GetStdHandle CancelIoEx Sleep LoadLibraryW GetProcAddress GetOEMCP GetACP IsValidCodePage GetConsoleOutputCP GetTimeZoneInformation SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetFileSizeEx ReadConsoleW GetConsoleMode ExitProcess GetModuleHandleExW FreeLibraryAndExitThread HeapFree SizeofResource ReadFile CreateDirectoryW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetModuleHandleW ExitThread CreateThread GetFileType GetCommandLineA LoadLibraryExW FormatMessageA ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared InitializeSRWLock EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection GetCurrentThreadId WaitForSingleObjectEx WriteConsoleW GetExitCodeThread QueryPerformanceCounter QueryPerformanceFrequency GetStringTypeW InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW FindFirstFileExW SetFilePointerEx AreFileApisANSI GetFileInformationByHandleEx EncodePointer LCMapStringEx GetSystemTimeAsFileTime CompareStringEx GetCPInfo InitializeCriticalSectionAndSpinCount ResetEvent IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead OutputDebugStringW RtlUnwind SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary

user32

FindWindowExW DestroyWindow IsWindowVisible DefWindowProcW RegisterClassExW DispatchMessageW SetTimer GetForegroundWindow TranslateMessage FindWindowW SetWindowLongW KillTimer PostQuitMessage GetAncestor GetWindowTextW UnregisterClassW GetMessageW PostMessageW GetWindowLongW CreateWindowExW

advapi32

RegDeleteKeyW RegCreateKeyExW RegEnumKeyExW RegSetValueExW RegOpenKeyExW RegOpenKeyW RegQueryValueExW RegCloseKey

shell32

ShellExecuteExW ShellExecuteW SHGetFolderPathA SHGetFolderPathW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_e86cb8985ea40ea4888703b9d20face2_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_virut

PE Signature issue

shlwapi

kernel32

user32

advapi32

shell32

generic