2026-08-07_ff9e48318faed15589ff811ac5e15bbd_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_virut

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-07_ff9e48318faed15589ff811ac5e15bbd_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_virut
Size 795KB
Sample260807-qyjfvseq2w
SHA256 2dd853cdca9ed362f67449491f999bd3d03ed40e21648f4bb75bff60284e78a3
MD5 ff9e48318faed15589ff811ac5e15bbd
SHA1 7418fa2c78bed0ea4479b0cedc50a3f2ca17cb5d
SHA512 9d15a6a7ef201a5dc332d7815f6cfade04bba5650f300fd5194b8ee663e29c1d420a608ee618de389f7293fea696ed131f05c3e277c59b6adf57dfd645620856
SSDEEP 12288:l1swdJMvWSIDcqgcq06wmJDR7N7ZqZA+aqIDa5n8T32F0SNrNf7:liwTKvAqz+aqlWT300SNBf7
TLSH
T160059E02B142C0B2E87111B115BDBF75DABDAD24477A09DBB3D45F3A9E202D23E3593A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-07_ff9e48318faed15589ff811ac5e15bbd_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_virut

File Explorer

2026-08-07_ff9e48318faed15589ff811ac5e15bbd_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_virut

.exe 795KB

2026-08-07_ff9e48318faed15589ff811ac5e15bbd_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_virut

IMPHASH 230c1ca075f8f1bca9e148567b0905fd
SHA256 2dd853cdca9ed362f67449491f999bd3d03ed40e21648f4bb75bff60284e78a3
MD5 ff9e48318faed15589ff811ac5e15bbd
SHA1 7418fa2c78bed0ea4479b0cedc50a3f2ca17cb5d
SHA512 9d15a6a7ef201a5dc332d7815f6cfade04bba5650f300fd5194b8ee663e29c1d420a608ee618de389f7293fea696ed131f05c3e277c59b6adf57dfd645620856
SSDEEP 12288:l1swdJMvWSIDcqgcq06wmJDR7N7ZqZA+aqIDa5n8T32F0SNrNf7:liwTKvAqz+aqlWT300SNBf7
TLSH
T160059E02B142C0B2E87111B115BDBF75DABDAD24477A09DBB3D45F3A9E202D23E3593A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

33:ad:dc:3e:0a:ca:f8:17:c1:77:e9:a9:3c:f6:4b:90:a1:65:8a:f8:ef:1f:ee:a4:9c:fc:bf:14:3a:5a:e6:80

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Beijing Duyou Science and Technology Co.\,Ltd.,O=Beijing Duyou Science and Technology Co.\,Ltd.,ST=Beijing,C=CN

Chains

Dec 25, 2024

CN=Beijing Duyou Science and Technology Co.\,Ltd.,O=Beijing Duyou Science and Technology Co.\,Ltd.,ST=Beijing,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

16:00:59:c2:8c:37:65:2d:9c:d7:9d:85:b9:17:b6:a9:22:eb:71:2c

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Beijing Duyou Science and Technology Co.\,Ltd.,O=Beijing Duyou Science and Technology Co.\,Ltd.,ST=Beijing,C=CN

Chains

Dec 25, 2024

CN=Beijing Duyou Science and Technology Co.\,Ltd.,O=Beijing Duyou Science and Technology Co.\,Ltd.,ST=Beijing,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 31, 2021 - Sep 17, 2029

Subject

CN=Certum Timestamp 2023,O=Asseco Data Systems S.A.,C=PL

Serial Number

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Nov 2, 2023 - Oct 30, 2034

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Beijing Duyou Science and Technology Co.\,Ltd.,O=Beijing Duyou Science and Technology Co.\,Ltd.,ST=Beijing,C=CN

Serial Number

0d:6a:73:d0:15:d3:84:9c:e5:43:01:d1:77:5c:08:f4

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 20, 2023 - Oct 22, 2026

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 15, 2024 - Apr 14, 2035

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

825025

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\jinjiqiang.INTERNAL\Desktop\project\c\crashpad\crashpad\out\win32\crashpad_handler.pdb

kernel32

InitializeCriticalSectionAndSpinCount LeaveCriticalSection DeleteCriticalSection SetLastError GetModuleFileNameW GetFileInformationByHandleEx GetCurrentProcess RegisterWaitForSingleObject GetQueuedCompletionStatus WaitForSingleObject DuplicateHandle DisconnectNamedPipe OpenProcess PostQueuedCompletionStatus CreateEventW SetEvent CreateThread UnregisterWaitEx CreateIoCompletionPort ConnectNamedPipe SetNamedPipeHandleState CreateNamedPipeW CreateFileW GetVersion TransactNamedPipe WaitNamedPipeW LoadLibraryW GetProcAddress FindClose CloseHandle TerminateProcess ReleaseSemaphore CreateSemaphoreW ReadFile GetFileSizeEx GetStdHandle WriteFile EnterCriticalSection UnlockFileEx SetFilePointerEx LockFileEx GetFileType GetModuleHandleW FormatMessageA LocalFree CreateDirectoryW GetFileAttributesW DeleteFileW GetTimeZoneInformation GetSystemInfo IsProcessorFeaturePresent VerSetConditionMask VerifyVersionInfoW GetProcessId SuspendThread ResumeThread GetThreadContext GetProcessTimes GetSystemDefaultLCID GetThreadLocale GetUserDefaultLCID IsWow64Process Sleep RaiseException AddVectoredExceptionHandler CreateProcessW SleepEx GetFullPathNameW GetCurrentProcessId GetLocalTime OutputDebugStringW GetLastError FormatMessageW GetCurrentThreadId SetUnhandledExceptionFilter SetProcessShutdownParameters SetEndOfFile GetCurrentDirectoryW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileInformationByHandle GetDriveTypeW SetConsoleCtrlHandler InitOnceExecuteOnce InitializeCriticalSection VirtualQueryEx ReadProcessMemory GetFileTime RemoveDirectoryW WriteConsoleW HeapSize GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage WideCharToMultiByte InitOnceComplete InitOnceBeginInitialize InitializeCriticalSectionEx EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetCommandLineA GetCommandLineW ExitProcess GetModuleHandleExW HeapAlloc HeapFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapReAlloc FindFirstFileExW FindNextFileW

advapi32

SystemFunction036 RegCloseKey RegQueryValueExA RegOpenKeyExW RegQueryValueExW BuildExplicitAccessWithNameW ConvertStringSecurityDescriptorToSecurityDescriptorW BuildSecurityDescriptorW RevertToSelf ImpersonateNamedPipeClient

user32

SetWindowLongW TranslateMessage RegisterClassW DispatchMessageW UnregisterClassW CreateWindowExW PostMessageW DefWindowProcW GetMessageW GetWindowLongW DestroyWindow

winhttp

WinHttpWriteData WinHttpSendRequest WinHttpSetTimeouts WinHttpCrackUrl WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpOpen WinHttpReceiveResponse WinHttpConnect

powrprof

CallNtPowerInformation

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-07_ff9e48318faed15589ff811ac5e15bbd_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_virut

PE Signature issue

PE Signature issue

kernel32

advapi32

user32

winhttp

powrprof

version

generic