2026-08-08_166a6aeb5125cf2d6b2b35f41ca5264e_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_166a6aeb5125cf2d6b2b35f41ca5264e_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat
Size 473KB
Sample260808-em99nahm2z
SHA256 fd5bc8f6b8a6dd1db43fc3e9267272bc1892e29014e94d5c5c09e8ee3e0a49ac
MD5 166a6aeb5125cf2d6b2b35f41ca5264e
SHA1 0f51c3f845f483f6af75e1b3b27c21c45e2ed462
SHA512 5e02e84b1edb879758ca2d80d08842ff4464a64c20f04dfac4b5877ae877f1ad16983c70b79fb668cf66a8768409a378a94fcfbe98cba7de4540b00f2ea6b422
SSDEEP 12288:2IP41XJgu19ylSJM2THKan7dJzkxfz8q9:HPAJgu1olY/z1k
TLSH
T15DA4AF01B890C031D572517A4EBDEB74AA7EFD300F9198CBB3C45EBD5A702C2AB3595A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-08_166a6aeb5125cf2d6b2b35f41ca5264e_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

.exe 473KB

2026-08-08_166a6aeb5125cf2d6b2b35f41ca5264e_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

IMPHASH 7335ab21730606b7b2df997185e03621
SHA256 fd5bc8f6b8a6dd1db43fc3e9267272bc1892e29014e94d5c5c09e8ee3e0a49ac
MD5 166a6aeb5125cf2d6b2b35f41ca5264e
SHA1 0f51c3f845f483f6af75e1b3b27c21c45e2ed462
SHA512 5e02e84b1edb879758ca2d80d08842ff4464a64c20f04dfac4b5877ae877f1ad16983c70b79fb668cf66a8768409a378a94fcfbe98cba7de4540b00f2ea6b422
SSDEEP 12288:2IP41XJgu19ylSJM2THKan7dJzkxfz8q9:HPAJgu1olY/z1k
TLSH
T15DA4AF01B890C031D572517A4EBDEB74AA7EFD300F9198CBB3C45EBD5A702C2AB3595A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

ae:4c:16:98:3f:9e:da:9c:0b:35:bf:68:e6:95:8b:c3:4c:dc:ca:ee:96:0e:f1:49:1d:5e:7f:34:5c:b0:92:e2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

Chains

Jul 9, 2026

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

Serial Number

44:85:59:e8:d5:9f:e0:56:29:9e:6e:8f

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 11, 2023 - Oct 9, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

175056

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\Webhost\10-07-2026\WindowsBuilds\INVENTORY_MGMT\13942668\inv_mgmt\Native_Src\native\ONPR_Win32\dcmetroapps.pdb

advapi32

ImpersonateLoggedOnUser RevertToSelf RegCloseKey RegEnumKeyExW RegOpenKeyExA RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExA RegQueryValueExW DeregisterEventSource RegisterEventSourceA ReportEventA RegDeleteValueA

shlwapi

StrStrIA ord487 StrTrimA

wtsapi32

WTSFreeMemory WTSQueryUserToken WTSEnumerateSessionsW

dcagentlibxml2

xmlFree xmlReadFile xmlCleanupParser xmlInitParser xmlNodeGetContent xmlFreeDoc xmlStrcmp xmlDocGetRootElement

kernel32

WakeAllConditionVariable GetCommandLineA ExitProcess ReadConsoleW CompareStringW LCMapStringW GetLocaleInfoW GetConsoleMode IsValidLocale GetUserDefaultLCID EnumSystemLocalesW QueryPerformanceCounter ReleaseSRWLockExclusive GetConsoleOutputCP SetFilePointerEx GetModuleHandleExW IsValidCodePage CreateDirectoryW GetCommandLineW FlushFileBuffers GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetCurrentProcessId SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead OutputDebugStringW RaiseException RtlUnwind InterlockedPushEntrySList TlsAlloc TlsGetValue AcquireSRWLockExclusive SetLastError FormatMessageW GetModuleFileNameW TlsSetValue TlsFree LoadLibraryExW FormatMessageA LocalFree SetEndOfFile GetFileType GetSystemTimeAsFileTime GetStdHandle SetStdHandle CreateFileA GetFileAttributesW GetFileAttributesExW WriteFile CloseHandle GetLastError MultiByteToWideChar WideCharToMultiByte GetCurrentThreadId GetLocalTime ReleaseMutex WaitForSingleObject Sleep CreateMutexA DecodePointer HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection DeleteFileA FindFirstFileA FindNextFileA GetFileSizeEx InitializeCriticalSectionAndSpinCount CreateTimerQueue CreateTimerQueueTimer DeleteTimerQueue FindResourceExW LoadResource LockResource SizeofResource FindResourceW CopyFileA CreateFileW FindClose FindNextFileW GetCurrentProcess TerminateProcess FreeLibrary GetProcAddress LoadLibraryW GetTimeZoneInformation ReadFile WriteConsoleW

ole32

CoUninitialize CoInitializeEx

oleaut32

GetErrorInfo SysAllocString SysFreeString SysStringLen SetErrorInfo VariantClear

odbc32

ord18 ord48 ord19 ord36 ord43 ord16 ord31 ord13 ord12 ord11 ord29 ord9 ord8 ord26 ord4 ord3 ord49 ord1 ord72 ord41 ord20 ord39 ord2

api-ms-win-core-string-l1-1-0

GetStringTypeW

api-ms-win-core-localization-l1-2-0

GetCPInfo LCMapStringEx

api-ms-win-core-file-l1-1-0

FindFirstFileExW

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

api-ms-win-core-synch-l1-1-0

EnterCriticalSection LeaveCriticalSection

api-ms-win-core-util-l1-1-0

EncodePointer

generic

count=233, id=261, version=28900,

count=10, id=253, version=33731,

count=26, id=259, version=33731,

count=20, id=260, version=33731,

count=32, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=7, id=261, version=33143,

count=101, id=261, version=33731,

count=2, id=262, version=28900,

count=16, id=259, version=28900,

count=25, id=260, version=28900,

count=2, id=257, version=35209,

count=491, id=1, productName=Unmarked objects,

count=45, id=257, version=28900,

count=13, id=260, version=33811,

count=3, id=261, version=35222,

count=37, id=260, version=33818,

count=34, id=261, version=33811,

count=1, id=255, version=33811,

count=1, id=151,

count=1, id=258, version=33811,