2026-08-09_2d6025f4692f026dca5c40895b9a6760_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_2d6025f4692f026dca5c40895b9a6760_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat
Size 459KB
Sample260809-hrwtlswwfs
SHA256 8398539920a2f438184216363dba12a1822c3cb8f127d76c69f4f1d9ddab60a5
MD5 2d6025f4692f026dca5c40895b9a6760
SHA1 c35242e6711ab32786cab52158f2f66fc9b06b23
SHA512 c7fa999284527de6917d7912ccb14625b26e4546c77eb1c6aaca44b9fbd8ca0857b9a04195c4434dc09f979aff9a78b97ad32fdc58c2e60b2144bfa1195229fd
SSDEEP 6144:ZQwUh1m3WGSBYq5Nk93GnVFqIw0HklNCO3gUN5AOfYTB1t2oamoBV+UdvrEFp7hL:S1vBYqY9WeI3OpN5lYTJ2RmoBjvrEH79
TLSH
T14CA49F117182C272D07211702A69FFB29AFDB9384FA615DFB3C45F2A5D282C26A35F17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-09_2d6025f4692f026dca5c40895b9a6760_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

File Explorer

2026-08-09_2d6025f4692f026dca5c40895b9a6760_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

.exe 459KB

2026-08-09_2d6025f4692f026dca5c40895b9a6760_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

IMPHASH 5a3a271d0eda2b713acf0d2e5f207fa8
SHA256 8398539920a2f438184216363dba12a1822c3cb8f127d76c69f4f1d9ddab60a5
MD5 2d6025f4692f026dca5c40895b9a6760
SHA1 c35242e6711ab32786cab52158f2f66fc9b06b23
SHA512 c7fa999284527de6917d7912ccb14625b26e4546c77eb1c6aaca44b9fbd8ca0857b9a04195c4434dc09f979aff9a78b97ad32fdc58c2e60b2144bfa1195229fd
SSDEEP 6144:ZQwUh1m3WGSBYq5Nk93GnVFqIw0HklNCO3gUN5AOfYTB1t2oamoBV+UdvrEFp7hL:S1vBYqY9WeI3OpN5lYTJ2RmoBjvrEH79
TLSH
T14CA49F117182C272D07211702A69FFB29AFDB9384FA615DFB3C45F2A5D282C26A35F17
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

14:c6:8d:4f:42:77:47:89:a2:e2:6f:8c:ad:00:88:39:13:31:0a:9b:8c:49:9d:f6:a2:ee:f1:4b:75:e6:92:4d

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Sep 11, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

09:8a:2f:31:3a:b2:c2:9c:d4:2b:06:2a:0e:46:7b:0c

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 3, 2023 - Nov 4, 2025

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

122048

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\workspace\ccd-app\nightly_build\build\msvs_win32_x86\Release\x86\sym\RuntimeCustomHook\RuntimeCustomHook\RuntimeCustomHook.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

shlwapi

PathAppendW PathRemoveFileSpecW PathFindFileNameW PathFileExistsW PathRemoveExtensionW PathAddExtensionW PathIsFileSpecW PathIsDirectoryW PathRenameExtensionW

kernel32

GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW GetACP SetStdHandle GetConsoleOutputCP SetEndOfFile WriteConsoleW SetEnvironmentVariableW GetCurrentProcessId FindFirstFileW FindNextFileW WriteFile SetFilePointer GetTempPathW CreateFileW GetCurrentThreadId GetLastError DeleteFileW CloseHandle lstrcmpW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection InitializeCriticalSectionEx DecodePointer HeapFree GetCurrentProcess GetVersionExW CreateEventW HeapAlloc GetProcAddress LocalFree VerSetConditionMask GetProcessHeap GetModuleHandleW VerifyVersionInfoW ReadFile GetFileSizeEx GetModuleFileNameW FindClose GetFileAttributesW SetFileAttributesW MoveFileExW FlushFileBuffers SetLastError TerminateProcess WaitForSingleObject HeapSize SetEvent HeapReAlloc ResetEvent CreateProcessW GetExitCodeProcess MultiByteToWideChar FileTimeToSystemTime GetLocalTime GetTimeFormatW SystemTimeToFileTime WideCharToMultiByte GetDateFormatW CreateMutexW ReleaseMutex OpenMutexW GetFileInformationByHandle GetUserDefaultLangID FreeLibrary GetUserDefaultUILanguage IsValidCodePage LCMapStringW GetUserDefaultLCID GetStringTypeW EncodePointer LCMapStringEx GetCPInfo InitializeCriticalSectionAndSpinCount WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW RaiseException RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetTimeZoneInformation ExitProcess GetModuleHandleExW GetStdHandle GetCommandLineA GetCommandLineW GetFileType CompareStringW GetLocaleInfoW IsValidLocale EnumSystemLocalesW GetConsoleMode ReadConsoleW SetFilePointerEx FindFirstFileExW

advapi32

RegQueryValueExW RegCloseKey RegOpenKeyExW

shell32

SHGetSpecialFolderPathW SHCreateDirectoryExW

oleaut32

VariantClear

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_2d6025f4692f026dca5c40895b9a6760_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

PE Signature issue

version

shlwapi

kernel32

advapi32

shell32

oleaut32

generic