2026-08-06_a3067ac15732368ffd8f6d12c5ce4bf9_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader

General

Target
2026-08-06_a3067ac15732368ffd8f6d12c5ce4bf9_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader
Size 213KB
Sample260807-arew4adb59
SHA256 bccc177fd6d7a22e28007257c68bbf535574a75703a162b4c6a4a745a4d8d06e
MD5 a3067ac15732368ffd8f6d12c5ce4bf9
SHA1 6611dd0366ab65a3b348361b220be7ffc7567538
SHA512 fd358bbe91403a41ea50687b0150363bf46552b64587592daff02c1ef6dadc6d9801964208b4df61a1f5d7fa57f2f7a451d009ade83d6f1de1ee4f014f73d55d
SSDEEP 6144:W3xM390OaHjJ6cyOGRF7zP8I/KTGq/AOy0NS8S:WyaHjJ6cylHhe88S
TLSH
T138247C10B592C472D572253149E4EBB64A7DF8300F6459EBA7D41F7E8F303C2AA31A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-06_a3067ac15732368ffd8f6d12c5ce4bf9_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader

File Explorer

2026-08-06_a3067ac15732368ffd8f6d12c5ce4bf9_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader

.exe 213KB

2026-08-06_a3067ac15732368ffd8f6d12c5ce4bf9_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader

IMPHASH 8bde36c5468d6860bb91ec4e0d10cf26
SHA256 bccc177fd6d7a22e28007257c68bbf535574a75703a162b4c6a4a745a4d8d06e
MD5 a3067ac15732368ffd8f6d12c5ce4bf9
SHA1 6611dd0366ab65a3b348361b220be7ffc7567538
SHA512 fd358bbe91403a41ea50687b0150363bf46552b64587592daff02c1ef6dadc6d9801964208b4df61a1f5d7fa57f2f7a451d009ade83d6f1de1ee4f014f73d55d
SSDEEP 6144:W3xM390OaHjJ6cyOGRF7zP8I/KTGq/AOy0NS8S:WyaHjJ6cylHhe88S
TLSH
T138247C10B592C472D572253149E4EBB64A7DF8300F6459EBA7D41F7E8F303C2AA31A6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects Windows executables referencing non-Windows User-Agents
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

29378

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Sleep GetLastError CreateEventA SetEndOfFile HeapSize CreateFileW GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW GetCurrentProcess TerminateProcess RtlUnwind RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameW GetCommandLineA GetCommandLineW GetFileSizeEx SetFilePointerEx GetFileType HeapAlloc HeapFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode CloseHandle ReadFile ReadConsoleW HeapReAlloc WriteConsoleW

user32

MessageBoxA

shell32

ShellExecuteA

wininet

InternetSetOptionA HttpQueryInfoA InternetOpenA HttpSendRequestA InternetReadFile HttpOpenRequestA InternetConnectA InternetQueryDataAvailable

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-06_a3067ac15732368ffd8f6d12c5ce4bf9_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader

kernel32

user32

shell32

wininet

generic