2026-08-09_1b37b8783f6e2833adf1608f0d79521b_amadey_cobalt-strike_darkgate_elex_floxif_luca-stealer_lynx_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_1b37b8783f6e2833adf1608f0d79521b_amadey_cobalt-strike_darkgate_elex_floxif_luca-stealer_lynx_njrat_smoke-loader
Size 934KB
Sample260809-gg47kavxcs
SHA256 9319f466abef322f09ca898c8efba82bd8984ff2897512479f4e81ea68cac90b
MD5 1b37b8783f6e2833adf1608f0d79521b
SHA1 1548a0cd256748dee2752ae7f5520f7e79e51796
SHA512 c87f5b440c92a8400628b09198c95a9048c787c9a590e39482da0cdd825a4e2f67188d9c9682a5b6d81088ddc7b7ffbf8dceec29f5137d809df352bf15463c08
SSDEEP 12288:yt9h/jrEby+dHRGCKNeJogzrgkcjhBjvrEH7jn:yt9h/jrEbyuRG7SwZ/rEH7jn
TLSH
T1BD1506207744F0E3C1A10A32EFE4B7B45DAE9AE476F73D4762D4A7582DE4581BE24283
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-09_1b37b8783f6e2833adf1608f0d79521b_amadey_cobalt-strike_darkgate_elex_floxif_luca-stealer_lynx_njrat_smoke-loader

File Explorer

2026-08-09_1b37b8783f6e2833adf1608f0d79521b_amadey_cobalt-strike_darkgate_elex_floxif_luca-stealer_lynx_njrat_smoke-loader

.exe 934KB

2026-08-09_1b37b8783f6e2833adf1608f0d79521b_amadey_cobalt-strike_darkgate_elex_floxif_luca-stealer_lynx_njrat_smoke-loader

IMPHASH 1501e42323efbe1944ec5414d458597c
SHA256 9319f466abef322f09ca898c8efba82bd8984ff2897512479f4e81ea68cac90b
MD5 1b37b8783f6e2833adf1608f0d79521b
SHA1 1548a0cd256748dee2752ae7f5520f7e79e51796
SHA512 c87f5b440c92a8400628b09198c95a9048c787c9a590e39482da0cdd825a4e2f67188d9c9682a5b6d81088ddc7b7ffbf8dceec29f5137d809df352bf15463c08
SSDEEP 12288:yt9h/jrEby+dHRGCKNeJogzrgkcjhBjvrEH7jn:yt9h/jrEbyuRG7SwZ/rEH7jn
TLSH
T1BD1506207744F0E3C1A10A32EFE4B7B45DAE9AE476F73D4762D4A7582DE4581BE24283
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

68:f6:8d:40:c3:57:dc:a6:9d:e5:12:9b:77:59:95:b7:ce:d6:32:a4:35:49:38:c8:c6:c2:7c:73:d4:ac:0e:a7

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=110111-2002444,CN=Teruten Inc.,O=Teruten Inc.,L=Guro-gu,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130553656f756c,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Chains

Dec 20, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

06:df:da:62:2f:03:03:1d:7b:3f:b1:40:c8:f1:97:3e

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 29, 2024 - May 29, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

191047

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ProgramData\Jenkins\.jenkins\workspace\MASTER_ANTI_CAPTURE_V2\BIN\Release\cubectlsvc_up.pdb

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

kernel32

UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead GetTickCount GetFileSizeEx GetFileAttributesExA SetErrorMode DuplicateHandle GetVolumeInformationA UnlockFile SetFilePointer SetEndOfFile LockFile GetFullPathNameA GetFileSize FlushFileBuffers GetCPInfo GetOEMCP VirtualProtect GlobalFlags GetUserDefaultUILanguage GetSystemDefaultUILanguage GetLocaleInfoW LocalReAlloc GlobalHandle GlobalReAlloc TlsFree TlsSetValue TlsGetValue WriteConsoleW TlsAlloc InitializeCriticalSection GetThreadLocale SetFilePointerEx GetCurrentProcessId lstrcmpA OutputDebugStringW RtlUnwind SetStdHandle GetFileType GetCommandLineA GetCommandLineW VirtualAlloc VirtualQuery GetModuleHandleExW HeapQueryInformation ExitProcess GetTimeZoneInformation CompareStringW LCMapStringW MoveFileExW GetStringTypeW FindFirstFileExW FindNextFileW IsValidCodePage GetEnvironmentStringsW FreeEnvironmentStringsW GetCurrentThread CompareStringA GlobalGetAtomNameA GlobalFindAtomA GlobalAddAtomA FindResourceA lstrcmpW GlobalDeleteAtom LoadLibraryExW FreeLibrary GetSystemDirectoryW GetCurrentThreadId EncodePointer MulDiv GlobalLock GlobalUnlock FindFirstFileA FindClose FileTimeToLocalFileTime LoadLibraryW GetModuleHandleW GetModuleFileNameW InitializeCriticalSectionAndSpinCount SetLastError GetACP MultiByteToWideChar ConnectNamedPipe GetPrivateProfileStringA GetPrivateProfileIntA CreateEventA WTSGetActiveConsoleSessionId ResetEvent CreateThread WritePrivateProfileStringA SetEvent ProcessIdToSessionId GetSystemWindowsDirectoryA DisconnectNamedPipe WaitForMultipleObjects OutputDebugStringA WriteFile CreateNamedPipeA ReadFile LoadLibraryA GetFileAttributesA AllocConsole FormatMessageA SetEnvironmentVariableW CreateFileW GetConsoleOutputCP GetConsoleMode GlobalFree GlobalAlloc LeaveCriticalSection GetStdHandle EnterCriticalSection SetConsoleCtrlHandler LocalFree LocalAlloc GetFileTime SystemTimeToTzSpecificLocalTime GetVersionExA FileTimeToSystemTime GetUserDefaultLangID GetModuleFileNameA GetExitCodeProcess CreateDirectoryA WideCharToMultiByte GetProcessHeap DeleteCriticalSection GetProcAddress DecodePointer HeapAlloc FindResourceW LoadResource GetSystemInfo RaiseException CloseHandle HeapReAlloc Process32Next DeleteFileA LockResource CreateFileA GetLastError CopyFileA Sleep CreateToolhelp32Snapshot HeapSize OpenProcess GetModuleHandleA InitializeCriticalSectionEx TerminateProcess GetCurrentProcess HeapFree Process32First SizeofResource

user32

MessageBeep GetNextDlgGroupItem IsRectEmpty IntersectRect SetRect InvalidateRgn CopyAcceleratorTableA CharNextA CharUpperA ReleaseCapture SetCapture InvalidateRect KillTimer SetTimer RealChildWindowFromPoint LoadCursorA GetSysColorBrush DestroyMenu ClientToScreen ReleaseDC GetWindowDC GetDC TabbedTextOutA GrayStringA DrawTextExA DrawTextA GetDesktopWindow GetNextDlgTabItem EndDialog CreateDialogIndirectParamA MapDialogRect GetWindowThreadProcessId SetCursor PostQuitMessage GetCursorPos GetActiveWindow TranslateMessage GetMessageA LoadBitmapW SetMenuItemInfoA GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem IsDialogMessageA SetWindowTextA IsWindowEnabled MoveWindow ShowWindow GetMonitorInfoA MonitorFromWindow WinHelpA LoadIconA CallNextHookEx UnhookWindowsHookEx SetWindowsHookExA GetWindow GetLastActivePopup GetTopWindow GetClassNameA GetClassLongA SetWindowLongA GetWindowLongA PtInRect EqualRect CopyRect RegisterClipboardFormatA GetSysColor MapWindowPoints PostThreadMessageA SetWindowContextHelpId ScreenToClient MessageBoxA AdjustWindowRectEx GetWindowRect GetWindowTextA RemovePropA GetPropA SetPropA GetScrollPos RedrawWindow ValidateRect EndPaint BeginPaint SetForegroundWindow GetForegroundWindow SetActiveWindow UpdateWindow SetMenu GetMenu GetCapture GetKeyState GetFocus SetFocus GetDlgCtrlID GetDlgItem IsWindowVisible EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetWindowPos IsChild IsMenu IsWindow GetClassInfoExA GetClassInfoA CallWindowProcA PostMessageA GetMessageTime GetMessagePos PeekMessageA DispatchMessageA RegisterWindowMessageA GetMenuItemCount GetMenuItemID GetSubMenu GetParent OffsetRect SetRectEmpty SendDlgItemMessageA GetSystemMetrics LoadIconW SendMessageA GetClientRect IsIconic EnableWindow DestroyWindow RegisterClassA DefWindowProcA CreateWindowExA UnregisterClassA

gdi32

GetMapMode GetRgnBox CreateRectRgnIndirect GetTextColor GetBkColor ScaleWindowExtEx ScaleViewportExtEx OffsetViewportOrgEx SetWindowExtEx SetViewportOrgEx SetViewportExtEx ExtTextOutA TextOutA SetMapMode DeleteDC GetDeviceCaps SetBkColor SetTextColor GetObjectA CreateBitmap DeleteObject Escape GetClipBox GetStockObject GetViewportExtEx GetWindowExtEx PtVisible RectVisible RestoreDC SaveDC ExtSelectClipRgn SelectObject

winspool.drv

DocumentPropertiesA ClosePrinter OpenPrinterA

advapi32

OpenProcessToken RegDeleteValueA LookupPrivilegeValueA RegEnumValueA RegQueryValueA RegEnumKeyA GetSecurityDescriptorSacl SetSecurityDescriptorDacl SetEntriesInAclA CreateProcessAsUserA SetNamedSecurityInfoA SetTokenInformation GetNamedSecurityInfoA SetSecurityDescriptorSacl InitializeSecurityDescriptor ConvertStringSidToSidA ConvertStringSecurityDescriptorToSecurityDescriptorW DuplicateTokenEx DeregisterEventSource CreateServiceA StartServiceCtrlDispatcherA QueryServiceStatus CloseServiceHandle SetServiceStatus RegisterServiceCtrlHandlerA OpenSCManagerA GetUserNameA CopySid DeleteService ControlService StartServiceA LookupAccountNameA IsValidSid ReportEventA GetLengthSid OpenServiceA RegisterEventSourceA RegCreateKeyExA RegOpenKeyExA RegCreateKeyA AdjustTokenPrivileges RegCloseKey RegDeleteKeyA RegQueryValueExA RegSetValueExA

shell32

SHGetSpecialFolderPathA

comctl32

InitCommonControlsEx

shlwapi

PathIsUNCA PathStripToRootA PathFindFileNameA PathFindExtensionA

ole32

CreateILockBytesOnHGlobal StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CoGetClassObject CLSIDFromString CoInitialize CoCreateInstance CoCreateGuid CoUninitialize CLSIDFromProgID CoTaskMemFree CoTaskMemAlloc CoFreeUnusedLibraries OleInitialize OleUninitialize CoRevokeClassObject OleFlushClipboard OleIsCurrentClipboard CoRegisterMessageFilter

oleaut32

SysAllocString OleCreateFontIndirect SysFreeString SysAllocStringByteLen SysAllocStringLen VariantInit VariantClear VariantChangeType SysStringLen SystemTimeToVariantTime VariantTimeToSystemTime SafeArrayDestroy VariantCopy

oledlg

ord8

urlmon

URLDownloadToFileA

wtsapi32

WTSFreeMemory WTSQueryUserToken WTSEnumerateSessionsA

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

oleacc

CreateStdAccessibleObject LresultFromObject

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_1b37b8783f6e2833adf1608f0d79521b_amadey_cobalt-strike_darkgate_elex_floxif_luca-stealer_lynx_njrat_smoke-loader

PE Signature issue

version

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

urlmon

wtsapi32

userenv

oleacc

generic