2026-08-08_211afd3cfa6328370c569ea0295dcf54_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_211afd3cfa6328370c569ea0295dcf54_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat
Size 477KB
Sample260808-ejt39szdjg
SHA256 8050565f0f4b5ad023fd341681ada6961ebaa6ea8af5fee2b83158526384ee5b
MD5 211afd3cfa6328370c569ea0295dcf54
SHA1 a748f27b0a4aea210f0e61bc7dd219a8179a3e23
SHA512 fce8b57fe8b9a50cd75731537b54d7b9505a27e00567445536ef8d9465959bc446f10967b6c229a6a3302be31cf7b8ac88718fa431ad71cc11a8d2887028f02c
SSDEEP 12288:AYTNo2zXSQvg69CdjR/FbC3V7NXGeHN7562N/SkhMwIOhP:fm2zXl+djR/FbC31NXGet7ukemP
TLSH
T173A4AE21F995C432C42240711F28E7FB697DF9B44B6144DBB3D4AA392E6C2C17B3662E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-08_211afd3cfa6328370c569ea0295dcf54_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

.exe 477KB

2026-08-08_211afd3cfa6328370c569ea0295dcf54_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

IMPHASH b16383972c05165036251877bd7dc0e3
SHA256 8050565f0f4b5ad023fd341681ada6961ebaa6ea8af5fee2b83158526384ee5b
MD5 211afd3cfa6328370c569ea0295dcf54
SHA1 a748f27b0a4aea210f0e61bc7dd219a8179a3e23
SHA512 fce8b57fe8b9a50cd75731537b54d7b9505a27e00567445536ef8d9465959bc446f10967b6c229a6a3302be31cf7b8ac88718fa431ad71cc11a8d2887028f02c
SSDEEP 12288:AYTNo2zXSQvg69CdjR/FbC3V7NXGeHN7562N/SkhMwIOhP:fm2zXl+djR/FbC31NXGet7ukemP
TLSH
T173A4AE21F995C432C42240711F28E7FB697DF9B44B6144DBB3D4AA392E6C2C17B3662E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

26:10:27:1c:75:89:c4:d9:c2:a6:57:a8:b8:53:77:45:da:ac:af:92:7e:72:93:0b:ad:ff:ec:61:b1:08:69:af

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

Chains

Jul 9, 2026

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

Serial Number

24:bb:11:9c:e7:e7:1d:59:89:e0:c6:f6

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 21, 2025 - Oct 9, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

197872

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\Webhost\10-07-2026\WindowsBuilds\SECURE_USB_CONFIGURATION\13942659\secure_usb_config\Native_Src\native\ONPR_x86\dcusb32.pdb

setupapi

CM_Get_DevNode_Status CM_Enable_DevNode SetupDiEnumDeviceInterfaces SetupDiCallClassInstaller SetupDiGetDeviceInstanceIdW SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW SetupDiSetClassInstallParamsW SetupDiGetDeviceInterfaceDetailW SetupDiDestroyDeviceInfoList

wtsapi32

WTSFreeMemory WTSQuerySessionInformationA WTSQuerySessionInformationW WTSEnumerateSessionsW

advapi32

RegCreateKeyExW RegQueryValueExA RegOpenKeyExA RegGetValueW RegDeleteValueW RegisterEventSourceW ReportEventW RegDeleteKeyW RegQueryValueExW RegOpenKeyExW RegSetValueExW DeregisterEventSource RegCloseKey

shlwapi

SHDeleteKeyW

kernel32

GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle SetEndOfFile LCMapStringW FlushFileBuffers CompareStringW SizeofResource HeapFree InitializeCriticalSectionEx HeapSize GetLastError LockResource HeapReAlloc FindResourceExW LoadResource FindResourceW HeapAlloc DecodePointer HeapDestroy DeleteCriticalSection GetProcessHeap WideCharToMultiByte CreateDirectoryW ReadFile GetFileSizeEx WriteFile CreateFileW MultiByteToWideChar Sleep DeleteFileW CloseHandle GetProcAddress GetModuleHandleW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection CreateMutexW WaitForSingleObject ReleaseMutex GetLocalTime SystemTimeToFileTime GetSystemTime OpenProcess LoadLibraryW WriteConsoleW GetLogicalDrives FindFirstFileW GetCurrentProcess DeviceIoControl FindClose FormatMessageW K32GetModuleBaseNameW DeleteFileA GetWindowsDirectoryW LocalFree GetCurrentProcessId K32EnumProcessModules GetConsoleOutputCP GetFileType ReadConsoleW GetConsoleMode SetFilePointerEx GetCommandLineW GetCommandLineA GetStdHandle GetModuleFileNameW GetModuleHandleExW ExitProcess EncodePointer LCMapStringEx GetStringTypeW GetCPInfo IsDebuggerPresent OutputDebugStringW RaiseException ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW

shell32

SHCreateDirectoryExW

ole32

CoSetProxyBlanket CoInitializeEx CoCreateInstance CoUninitialize

oleaut32

SysFreeString SysAllocString VariantInit

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_211afd3cfa6328370c569ea0295dcf54_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

setupapi

wtsapi32

advapi32

shlwapi

kernel32

shell32

ole32

oleaut32

generic