2026-08-08_108dc63a2ece6ba5d81feecb02b2042d_amadey_cobalt-strike_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_medusalocker_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_108dc63a2ece6ba5d81feecb02b2042d_amadey_cobalt-strike_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_medusalocker_njrat
Size 989KB
Sample260808-13j83aff29
SHA256 760a5b46a01459a5e4eb4cb2065035b964e2febae810bcedfc74574796be1495
MD5 108dc63a2ece6ba5d81feecb02b2042d
SHA1 d5c58102f008e19c86bd3483f412dd86536ffc8e
SHA512 205a6edd75e1a281237d55b9812684a68659c9d46135c8a9ee5a2d7988ece8b032ac85893dd80c948978dbef551fa81d9d11546d3571c0ddd9f9cad5442511f6
SSDEEP 24576:YrggoAMPI9N322jq7pO8zwompCoKJC3uFPvL5BskTh7Bc4W6rEH7V:YrgLUjqlO8ixKJccpTw4Wv
TLSH
T1EF259F113382C5BAFF6282332A54E31583FEF9A50923861F2794777C6F391B25B2D652
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-08_108dc63a2ece6ba5d81feecb02b2042d_amadey_cobalt-strike_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_medusalocker_njrat

File Explorer

2026-08-08_108dc63a2ece6ba5d81feecb02b2042d_amadey_cobalt-strike_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_medusalocker_njrat

.exe 989KB

2026-08-08_108dc63a2ece6ba5d81feecb02b2042d_amadey_cobalt-strike_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_medusalocker_njrat

IMPHASH b1d04b1ebe040659866be4feed8055ce
SHA256 760a5b46a01459a5e4eb4cb2065035b964e2febae810bcedfc74574796be1495
MD5 108dc63a2ece6ba5d81feecb02b2042d
SHA1 d5c58102f008e19c86bd3483f412dd86536ffc8e
SHA512 205a6edd75e1a281237d55b9812684a68659c9d46135c8a9ee5a2d7988ece8b032ac85893dd80c948978dbef551fa81d9d11546d3571c0ddd9f9cad5442511f6
SSDEEP 24576:YrggoAMPI9N322jq7pO8zwompCoKJC3uFPvL5BskTh7Bc4W6rEH7V:YrgLUjqlO8ixKJccpTw4Wv
TLSH
T1EF259F113382C5BAFF6282332A54E31583FEF9A50923861F2794777C6F391B25B2D652
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

53:37:6c:ba:e7:17:bd:f6:9b:d6:54:29:42:78:17:d2:01:00:a8:22:92:77:e7:b0:72:ee:45:a9:92:17:3c:5c

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=91540195754285145H,CN=Wondershare Technology Group Co.\,Ltd,O=Wondershare Technology Group Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c0fe8a5bfe8978fe887aae6b2bbe58cba,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Aug 29, 2022

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

d7:c9:b2:68:3b:53:9b:32:09:72:ea:38:c8:2f:95:86:75:27:4f:c9

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

Chains

Aug 29, 2022

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 29, 2022 - Mar 14, 2033

Subject

Serial Number

05:99:17:fd:77:18:80:8b:c3:4b:e2:24:e4:15:21:6f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 8, 2022 - Apr 5, 2025

Minor OS version

Major OS version

Entry point

202347

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

iphlpapi

GetAdaptersInfo

kernel32

GetFileAttributesW GetFileAttributesExW RemoveDirectoryW SetFilePointer Sleep MoveFileExW GetEnvironmentVariableW SetEnvironmentVariableW GetSystemInfo GetVersionExW GetComputerNameW EnterCriticalSection LeaveCriticalSection FindClose FindFirstFileW FindNextFileW ResetEvent WaitForMultipleObjects InitializeCriticalSectionAndSpinCount TryEnterCriticalSection DeleteCriticalSection GetModuleFileNameW SetConsoleCtrlHandler FreeLibrary GetProcAddress LoadLibraryW VerSetConditionMask SetLastError CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus DeleteFileW QueueUserAPC TerminateThread TlsAlloc TlsGetValue TlsSetValue TlsFree FormatMessageA VerifyVersionInfoA MultiByteToWideChar FormatMessageW LocalFree WideCharToMultiByte GetSystemDirectoryW GetTempPathW GetLongPathNameW GetCurrentDirectoryW WriteFile ReadFile CreateEventW SetEvent GetStartupInfoW TerminateProcess GetCurrentProcessId DuplicateHandle GetStdHandle GetSystemTimeAsFileTime WTSGetActiveConsoleSessionId OpenProcess GetCurrentThread GetExitCodeProcess GetCurrentProcess WaitForSingleObject GetLastError CloseHandle SetWaitableTimer CreateFileW SetConsoleTextAttribute GetConsoleScreenBufferInfo WriteConsoleW HeapSize GetProcessHeap SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetTimeZoneInformation ReadConsoleW FlushFileBuffers GetConsoleMode GetConsoleCP SetFilePointerEx GetFileSizeEx HeapReAlloc QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx SwitchToThread GetCurrentThreadId GetExitCodeThread GetTickCount GetModuleHandleW EncodePointer DecodePointer CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW VirtualAlloc VirtualProtect VirtualFree ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx RaiseException RtlUnwind ExitThread GetModuleHandleExW ExitProcess GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType IsValidLocale GetUserDefaultLCID EnumSystemLocalesW

ole32

CoImpersonateClient

advapi32

RegOpenKeyExW ReportEventW RegisterEventSourceW RegSetValueExW RegCreateKeyExW RegCloseKey OpenServiceW OpenSCManagerW DeleteService CreateServiceW CloseServiceHandle ChangeServiceConfigW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW SetTokenInformation GetTokenInformation DuplicateTokenEx CreateProcessAsUserA OpenThreadToken OpenProcessToken DeregisterEventSource

ws2_32

WSASocketW WSASend WSAGetLastError WSASetLastError WSACleanup WSAStartup shutdown listen htons ioctlsocket closesocket bind WSARecv setsockopt

mswsock

AcceptEx GetAcceptExSockaddrs

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_108dc63a2ece6ba5d81feecb02b2042d_amadey_cobalt-strike_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_medusalocker_njrat

PE Signature issue

PE Signature issue

userenv

iphlpapi

kernel32

ole32

advapi32

ws2_32

mswsock

generic