2026-08-09_c486235c3c2f5d02de5a6102972b0676_amadey_cobalt-strike_darkgate_elex_floxif_luca-stealer_lynx_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_c486235c3c2f5d02de5a6102972b0676_amadey_cobalt-strike_darkgate_elex_floxif_luca-stealer_lynx_njrat_smoke-loader
Size 934KB
Sample260809-fl5hfs1bkd
SHA256 df01be0523b1652039931eb8a76356326057f93edf711276f8d566cdff773788
MD5 c486235c3c2f5d02de5a6102972b0676
SHA1 4bee4f44a555691dd89418094ed945e4e7fa04b1
SHA512 27cb57fac8da43a1c7b28acb08252bd9f31b2de6d5ea3fe79b50408208d997b2a1e292fd95543d3a764bcfbacbbbcb32e107cee32decba380623a23ec83fad4c
SSDEEP 12288:c0PybIb2qO1LSpGpeuLlspkLXUrgAYsJBjvrEH7JA:c0PyMb2qO1ppeIspkLX3NsXrEH76
TLSH
T1571506207344F0E3C2A10632DFE4B7B45DAE9AE476E73D4762D47B592DE4581BE28283
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-09_c486235c3c2f5d02de5a6102972b0676_amadey_cobalt-strike_darkgate_elex_floxif_luca-stealer_lynx_njrat_smoke-loader

File Explorer

2026-08-09_c486235c3c2f5d02de5a6102972b0676_amadey_cobalt-strike_darkgate_elex_floxif_luca-stealer_lynx_njrat_smoke-loader

.exe 934KB

2026-08-09_c486235c3c2f5d02de5a6102972b0676_amadey_cobalt-strike_darkgate_elex_floxif_luca-stealer_lynx_njrat_smoke-loader

IMPHASH ba8517c7f7b6b24108b5409f33027fba
SHA256 df01be0523b1652039931eb8a76356326057f93edf711276f8d566cdff773788
MD5 c486235c3c2f5d02de5a6102972b0676
SHA1 4bee4f44a555691dd89418094ed945e4e7fa04b1
SHA512 27cb57fac8da43a1c7b28acb08252bd9f31b2de6d5ea3fe79b50408208d997b2a1e292fd95543d3a764bcfbacbbbcb32e107cee32decba380623a23ec83fad4c
SSDEEP 12288:c0PybIb2qO1LSpGpeuLlspkLXUrgAYsJBjvrEH7JA:c0PyMb2qO1ppeIspkLX3NsXrEH76
TLSH
T1571506207344F0E3C2A10632DFE4B7B45DAE9AE476E73D4762D47B592DE4581BE28283
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

c4:67:98:d5:1f:94:3a:de:8d:03:4d:3a:61:ec:32:f7:fe:9d:58:4b:ad:ee:97:83:0d:74:62:94:ed:b9:0c:41

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=110111-2002444,CN=Teruten Inc.,O=Teruten Inc.,L=Guro District,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130553656f756c,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Chains

Jul 6, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

04:79:15:94:cc:4e:e3:9c:9d:ce:32:5d:5d:79:38:a9

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 29, 2026 - Jun 23, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

190583

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ProgramData\Jenkins\.jenkins\workspace\MASTER_ANTI_CAPTURE_V2\BIN\Release\cubectlsvc_up.pdb

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

kernel32

GetTickCount UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead GetFileSizeEx GetFileAttributesExA SetErrorMode DuplicateHandle GetVolumeInformationA UnlockFile SetFilePointer SetEndOfFile LockFile GetFullPathNameA GetFileSize FlushFileBuffers GetCPInfo GetOEMCP VirtualProtect GlobalFlags GetUserDefaultUILanguage GetSystemDefaultUILanguage GetLocaleInfoW LocalReAlloc GlobalHandle GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSection WriteConsoleW GetThreadLocale GetCurrentProcessId lstrcmpA GetCurrentThread SetFilePointerEx OutputDebugStringW RtlUnwind SetStdHandle GetFileType GetCommandLineA GetCommandLineW VirtualAlloc VirtualQuery GetModuleHandleExW HeapQueryInformation GetTimeZoneInformation CompareStringW LCMapStringW MoveFileExW GetStringTypeW FindFirstFileExW FindNextFileW IsValidCodePage GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringA GlobalGetAtomNameA GlobalFindAtomA GlobalAddAtomA FindResourceA lstrcmpW GlobalDeleteAtom LoadLibraryExW FreeLibrary GetSystemDirectoryW GetCurrentThreadId EncodePointer MulDiv GlobalLock GlobalUnlock FindFirstFileA FindClose FileTimeToLocalFileTime LoadLibraryW GetModuleHandleW GetModuleFileNameW InitializeCriticalSectionAndSpinCount SetLastError GetACP MultiByteToWideChar ConnectNamedPipe GetPrivateProfileStringA GetPrivateProfileIntA CreateEventA WTSGetActiveConsoleSessionId ResetEvent CreateThread WritePrivateProfileStringA SetEvent ProcessIdToSessionId GetSystemWindowsDirectoryA DisconnectNamedPipe ReleaseMutex WaitForSingleObject CreateMutexA GetProcessId WaitForMultipleObjects OutputDebugStringA WriteFile CreateNamedPipeA ReadFile LoadLibraryA QueryFullProcessImageNameA GetFileAttributesA AllocConsole FormatMessageA SetEnvironmentVariableW CreateFileW GetConsoleOutputCP GetConsoleMode ExitProcess GlobalFree GlobalAlloc LeaveCriticalSection GetStdHandle EnterCriticalSection SetConsoleCtrlHandler LocalFree LocalAlloc GetFileTime SystemTimeToTzSpecificLocalTime GetVersionExA FileTimeToSystemTime GetUserDefaultLangID GetModuleFileNameA GetExitCodeProcess CreateDirectoryA WideCharToMultiByte GetProcessHeap DeleteCriticalSection GetProcAddress DecodePointer HeapAlloc FindResourceW LoadResource GetSystemInfo RaiseException CloseHandle HeapReAlloc Process32Next DeleteFileA LockResource CreateFileA GetLastError CopyFileA Sleep CreateToolhelp32Snapshot HeapSize OpenProcess GetModuleHandleA InitializeCriticalSectionEx TerminateProcess GetCurrentProcess HeapFree Process32First SizeofResource

user32

MessageBeep GetNextDlgGroupItem IsRectEmpty IntersectRect SetRect InvalidateRgn CopyAcceleratorTableA CharNextA CharUpperA ReleaseCapture SetCapture InvalidateRect KillTimer SetTimer RealChildWindowFromPoint LoadCursorA GetSysColorBrush DestroyMenu ClientToScreen GetWindowDC GetDC TabbedTextOutA GrayStringA DrawTextExA DrawTextA GetDesktopWindow GetNextDlgTabItem EndDialog CreateDialogIndirectParamA MapDialogRect GetWindowThreadProcessId SetCursor PostQuitMessage GetCursorPos GetActiveWindow TranslateMessage GetMessageA LoadBitmapW SetMenuItemInfoA GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem IsDialogMessageA SetWindowTextA IsWindowEnabled MoveWindow ShowWindow GetMonitorInfoA MonitorFromWindow WinHelpA LoadIconA CallNextHookEx UnhookWindowsHookEx SetWindowsHookExA GetWindow GetLastActivePopup GetTopWindow GetClassNameA GetClassLongA SetWindowLongA GetWindowLongA PtInRect EqualRect CopyRect RegisterClipboardFormatA GetSysColor MapWindowPoints PostThreadMessageA SetWindowContextHelpId ScreenToClient MessageBoxA AdjustWindowRectEx GetWindowRect GetWindowTextA RemovePropA GetPropA SetPropA GetScrollPos RedrawWindow ValidateRect EndPaint BeginPaint SetForegroundWindow GetForegroundWindow SetActiveWindow UpdateWindow SetMenu GetMenu GetCapture GetKeyState GetFocus SetFocus GetDlgCtrlID GetDlgItem IsWindowVisible EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetWindowPos IsChild IsMenu IsWindow GetClassInfoExA GetClassInfoA CallWindowProcA PostMessageA GetMessageTime GetMessagePos PeekMessageA DispatchMessageA RegisterWindowMessageA GetMenuItemCount GetMenuItemID GetSubMenu GetParent OffsetRect SetRectEmpty SendDlgItemMessageA GetSystemMetrics LoadIconW SendMessageA GetClientRect IsIconic EnableWindow DestroyWindow RegisterClassA DefWindowProcA CreateWindowExA UnregisterClassA ReleaseDC

gdi32

GetMapMode GetRgnBox CreateRectRgnIndirect GetTextColor GetBkColor ScaleWindowExtEx ScaleViewportExtEx OffsetViewportOrgEx SetWindowExtEx SetViewportOrgEx SetViewportExtEx ExtTextOutA TextOutA SetMapMode DeleteDC GetDeviceCaps SetBkColor SetTextColor GetObjectA CreateBitmap DeleteObject Escape GetClipBox GetStockObject GetViewportExtEx GetWindowExtEx PtVisible RectVisible RestoreDC SaveDC ExtSelectClipRgn SelectObject

winspool.drv

DocumentPropertiesA ClosePrinter OpenPrinterA

advapi32

OpenProcessToken RegDeleteValueA LookupPrivilegeValueA RegEnumValueA RegQueryValueA RegEnumKeyA GetSecurityDescriptorSacl SetSecurityDescriptorDacl SetEntriesInAclA CreateProcessAsUserA SetNamedSecurityInfoA SetTokenInformation GetNamedSecurityInfoA SetSecurityDescriptorSacl InitializeSecurityDescriptor ConvertStringSidToSidA ConvertStringSecurityDescriptorToSecurityDescriptorW DuplicateTokenEx DeregisterEventSource CreateServiceA StartServiceCtrlDispatcherA QueryServiceStatus CloseServiceHandle SetServiceStatus RegisterServiceCtrlHandlerA OpenSCManagerA GetUserNameA CopySid DeleteService ControlService StartServiceA LookupAccountNameA IsValidSid ReportEventA GetLengthSid OpenServiceA RegisterEventSourceA RegCreateKeyExA RegOpenKeyExA RegCreateKeyA AdjustTokenPrivileges RegCloseKey RegDeleteKeyA RegQueryValueExA RegSetValueExA

shell32

SHGetSpecialFolderPathA

comctl32

InitCommonControlsEx

shlwapi

PathIsUNCA PathStripToRootA PathFindFileNameA PathFindExtensionA

ole32

CreateILockBytesOnHGlobal StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CoGetClassObject CLSIDFromString CoInitialize CoCreateInstance CoCreateGuid CoUninitialize CLSIDFromProgID CoTaskMemFree CoTaskMemAlloc CoFreeUnusedLibraries OleInitialize OleUninitialize CoRevokeClassObject OleFlushClipboard OleIsCurrentClipboard CoRegisterMessageFilter

oleaut32

SysAllocString OleCreateFontIndirect SysFreeString SysAllocStringByteLen SysAllocStringLen VariantInit VariantClear VariantChangeType SysStringLen SystemTimeToVariantTime VariantTimeToSystemTime SafeArrayDestroy VariantCopy

oledlg

ord8

urlmon

URLDownloadToFileA

wtsapi32

WTSFreeMemory WTSQueryUserToken WTSEnumerateSessionsA

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

oleacc

CreateStdAccessibleObject LresultFromObject

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_c486235c3c2f5d02de5a6102972b0676_amadey_cobalt-strike_darkgate_elex_floxif_luca-stealer_lynx_njrat_smoke-loader

PE Signature issue

version

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

urlmon

wtsapi32

userenv

oleacc

generic