General
- Target 2026-08-10_58761297df8267f2f58cdfd37db12795_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat
- Size 707KB
- Sample260810-jagh2adl2w
- SHA256 4019b803e1ae6be5cbbe4e0bd241d5421817146d9f4ba7e931fc2cb6cd93e0ab
- MD5 58761297df8267f2f58cdfd37db12795
- SHA1 6a7a41e3aa00990b8f9f6e99199cc8f9d7126dd1
- SHA512 819ae735d9b9109c099cb38cb7d5ba7773a590c16262a8e07a8b45e4e1a4541e465543a1d4ed325ed85c5059c3e61b44cc7d28c03392103e24cbc53524b97b36
- SSDEEP 12288:0g7AIDQUi3Qx8SMi8wF9Cp6cwuOunHi+mKfIQp9GiFR6WQpQoUByGncANapNwnvu:0KBDQr3IbCEcwTujRlpg1rsyt+ap2v+X
- TLSH T175F4020174848473E973253205E0E6B96B7EFC700E659D9F67980FAF0F31683AA356A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_58761297df8267f2f58cdfd37db12795_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_58761297df8267f2f58cdfd37db12795_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
Resource
win11ltsc2024-20260710-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-10_58761297df8267f2f58cdfd37db12795_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat
- Size 707KB
- SHA256 4019b803e1ae6be5cbbe4e0bd241d5421817146d9f4ba7e931fc2cb6cd93e0ab
- MD5 58761297df8267f2f58cdfd37db12795
- SHA1 6a7a41e3aa00990b8f9f6e99199cc8f9d7126dd1
- SHA512 819ae735d9b9109c099cb38cb7d5ba7773a590c16262a8e07a8b45e4e1a4541e465543a1d4ed325ed85c5059c3e61b44cc7d28c03392103e24cbc53524b97b36
- SSDEEP 12288:0g7AIDQUi3Qx8SMi8wF9Cp6cwuOunHi+mKfIQp9GiFR6WQpQoUByGncANapNwnvu:0KBDQr3IbCEcwTujRlpg1rsyt+ap2v+X
- TLSH T175F4020174848473E973253205E0E6B96B7EFC700E659D9F67980FAF0F31683AA356A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Family: RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Detects executables packed with Babel
-
Suspicious use of SetThreadContext