2026-08-08_effafebdf2dfb300b8dfd7c898caabd3_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_effafebdf2dfb300b8dfd7c898caabd3_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat
Size 445KB
Sample260808-cwmtlsbb82
SHA256 7a7984ebc6bf0c6e12c339e93255a8093a16c98aca33334a4eec2f416d9fd19b
MD5 effafebdf2dfb300b8dfd7c898caabd3
SHA1 85d264a0d71025240f0be396f81577cb815a2ebd
SHA512 a2e5c5a0b7e8eec087471097061aca9f3262d7bb73eb706aac915062d8a788a98b30da9c0cf28cc613513a9124448c479e5749bc4eafc663b1f56e0d6f3ea91a
SSDEEP 12288:9e4HdMg8ZluAh3G4kiD/eZcxM4SRepnbzzd:wKdMrfBj/nhx
TLSH
T159A4BF11FA81C031E17111794EB4DBB5EA3DF9300B51D8CBA3D469799BB42C1AB3A78E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-08_effafebdf2dfb300b8dfd7c898caabd3_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

.exe 445KB

2026-08-08_effafebdf2dfb300b8dfd7c898caabd3_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

IMPHASH 00173283a7b1c41ae264ac24c1272a0a
SHA256 7a7984ebc6bf0c6e12c339e93255a8093a16c98aca33334a4eec2f416d9fd19b
MD5 effafebdf2dfb300b8dfd7c898caabd3
SHA1 85d264a0d71025240f0be396f81577cb815a2ebd
SHA512 a2e5c5a0b7e8eec087471097061aca9f3262d7bb73eb706aac915062d8a788a98b30da9c0cf28cc613513a9124448c479e5749bc4eafc663b1f56e0d6f3ea91a
SSDEEP 12288:9e4HdMg8ZluAh3G4kiD/eZcxM4SRepnbzzd:wKdMrfBj/nhx
TLSH
T159A4BF11FA81C031E17111794EB4DBB5EA3DF9300B51D8CBA3D469799BB42C1AB3A78E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

57:71:6c:ac:09:c5:7e:4a:3c:00:2f:e8:7b:da:83:47:37:a1:5c:ce:4a:74:69:c7:31:08:72:a8:d3:62:76:b0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

Chains

Jul 9, 2026

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

Serial Number

24:bb:11:9c:e7:e7:1d:59:89:e0:c6:f6

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 21, 2025 - Oct 9, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

161760

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\Webhost\10-07-2026\WindowsBuilds\ME_ONE_AGENT\13942667\meoneagentvs22\MEONEAGENT\native\agent\Release\meaaphelper.pdb

advapi32

RegOpenKeyExA RegCloseKey RegCreateKeyExA RegDeleteValueA RegQueryValueExA RegQueryValueExW RegSetValueExW

shlwapi

StrTrimA StrStrIA

kernel32

AcquireSRWLockExclusive WakeAllConditionVariable ReleaseSRWLockExclusive CompareStringW SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCommandLineW IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead RtlUnwind GetUserDefaultLCID EnumSystemLocalesW SetStdHandle SetFilePointerEx GetConsoleOutputCP TlsAlloc TlsGetValue TlsSetValue IsValidLocale GetLocaleInfoW LCMapStringW LoadLibraryExW GetFileType GetConsoleMode ReadConsoleW LCMapStringEx GetCPInfo EncodePointer GetStringTypeW GetModuleHandleW SetEndOfFile IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW TlsFree GetModuleHandleExW ExitProcess GetStdHandle FindFirstFileExW GetCommandLineA LeaveCriticalSection EnterCriticalSection RaiseException SizeofResource HeapFree InitializeCriticalSectionEx HeapSize GetLastError LockResource HeapReAlloc FindResourceExW LoadResource FindResourceW HeapAlloc DecodePointer HeapDestroy DeleteCriticalSection GetProcessHeap WideCharToMultiByte ExpandEnvironmentStringsA DeleteFileA GetProcAddress FreeLibrary CreateFileA FindClose FindFirstFileA FindNextFileA ReadFile WriteFile CloseHandle ReleaseMutex WaitForSingleObject CreateMutexA Sleep GetCurrentProcess TerminateProcess GetExitCodeProcess GetVersionExA LoadLibraryA GetCurrentThreadId GetLocalTime CreateDirectoryW CreateFileW FlushFileBuffers GetCurrentProcessId MultiByteToWideChar GetFileSizeEx SetCurrentDirectoryA GetCurrentDirectoryA FindNextFileW SetLastError CreateProcessA CopyFileA InitializeCriticalSectionAndSpinCount CreateTimerQueue CreateTimerQueueTimer DeleteTimerQueue GetSystemTimeAsFileTime LocalFree FormatMessageA FormatMessageW QueryPerformanceCounter GetModuleFileNameW OutputDebugStringW IsDebuggerPresent WriteConsoleW

shell32

SHCreateDirectoryExA

oleaut32

VariantClear

odbc32

ord39 ord20 ord16 ord72 ord41 ord49 ord19 ord36 ord31 ord13 ord12 ord11 ord29 ord43 ord9 ord8 ord26 ord4 ord3 ord2 ord1 ord48 ord18

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_effafebdf2dfb300b8dfd7c898caabd3_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

advapi32

shlwapi

kernel32

shell32

oleaut32

odbc32

generic