2026-08-11_a6364fe957562295e2016d217df2783a_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-11_a6364fe957562295e2016d217df2783a_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat_remcos
Size 707KB
Sample260811-2cdt2atanf
SHA256 28d614e56b8121985e33c87b72ca63556e4c0ab06f94f1562dc2c86eacb90bbf
MD5 a6364fe957562295e2016d217df2783a
SHA1 009eb98d93e53527f88eeac4a1cc7a8e86d2b537
SHA512 d94ca1c14f7a97ceedab6e94f4cf31d00745777c0e9b0326ea37615a75d0a2dac191797c525bb6e6ba2b15892c3dec5122b32f1e924461d1ae7fdf62204b0e3e
SSDEEP 12288:8RIMVJpgFWo8i5R61VHATM+tOuVlrviSlbiDsfPtsYAXVx2kS5HrWBjvrEH73:8FVJi4o8i5R61VHATM+jrviWbiUtsYqS
TLSH
T1FCF46C10AEEBC9EBC12B223FB819AD4214DEE775075341D7A7800D39B7A81E39D255E3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-11_a6364fe957562295e2016d217df2783a_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat_remcos

File Explorer

2026-08-11_a6364fe957562295e2016d217df2783a_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat_remcos

.exe 707KB

2026-08-11_a6364fe957562295e2016d217df2783a_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat_remcos

IMPHASH 5ba57d2d54aff9a1eb5b19ba94a3b880
SHA256 28d614e56b8121985e33c87b72ca63556e4c0ab06f94f1562dc2c86eacb90bbf
MD5 a6364fe957562295e2016d217df2783a
SHA1 009eb98d93e53527f88eeac4a1cc7a8e86d2b537
SHA512 d94ca1c14f7a97ceedab6e94f4cf31d00745777c0e9b0326ea37615a75d0a2dac191797c525bb6e6ba2b15892c3dec5122b32f1e924461d1ae7fdf62204b0e3e
SSDEEP 12288:8RIMVJpgFWo8i5R61VHATM+tOuVlrviSlbiDsfPtsYAXVx2kS5HrWBjvrEH73:8FVJi4o8i5R61VHATM+jrviWbiUtsYqS
TLSH
T1FCF46C10AEEBC9EBC12B223FB819AD4214DEE775075341D7A7800D39B7A81E39D255E3
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

82:a2:4f:3c:10:ae:d4:bf:e6:ee:12:dc:b1:83:75:5b:1e:ce:c7:0c:38:6d:91:f6:16:cd:43:e2:74:ed:b9:20

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Nvidia Corporation,OU=IT-MIS,O=Nvidia Corporation,L=Santa Clara,ST=California,C=US

Chains

Mar 30, 2022

CN=Nvidia Corporation,OU=IT-MIS,O=Nvidia Corporation,L=Santa Clara,ST=California,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Nvidia Corporation,OU=IT-MIS,O=Nvidia Corporation,L=Santa Clara,ST=California,C=US

Serial Number

05:51:00:fd:bc:b3:e2:f4:70:a6:27:f0:3f:cf:e5:b8

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 14, 2022 - Sep 14, 2022

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

223664

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\dvs\p4\build\sw\rel\gfclient\rel_03_25_1\nodejs\launcher\winxp_x86_release\nvnodejslauncher.pdb

shell32

CommandLineToArgvW SHGetKnownFolderPath SHGetFolderPathW

shlwapi

PathRemoveFileSpecW

oleaut32

SysAllocString SysFreeString VariantClear VariantInit

ole32

CoInitialize CoCreateInstance CoTaskMemFree

kernel32

GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage CreateDirectoryW GetCommandLineW GetCurrentProcess WriteFile GetModuleFileNameW K32GetModuleFileNameExW InitializeCriticalSectionEx WaitForSingleObject CreateFileW GetFileAttributesW OpenEventW OpenProcess CreateToolhelp32Snapshot CreateEventW Sleep GetTickCount64 GetLastError Process32NextW SetEvent QueryPerformanceFrequency Process32FirstW CloseHandle SetCurrentDirectoryW LocalFree MoveFileExW FreeEnvironmentStringsW CreateProcessW GetModuleHandleW SystemTimeToTzSpecificLocalTime GetSystemTime QueryPerformanceCounter GetProcAddress FreeLibrary ReadFile GetFileSizeEx RaiseException DecodePointer DeleteCriticalSection WideCharToMultiByte GetModuleFileNameA SetLastError GetFullPathNameW ExpandEnvironmentStringsW LocalAlloc lstrcmpA GetSystemDirectoryW OutputDebugStringW FileTimeToSystemTime VerSetConditionMask VerifyVersionInfoW lstrcmpW LoadLibraryExW GetTimeZoneInformation HeapReAlloc EnumSystemLocalesW GetProcessHeap SetStdHandle HeapSize FlushFileBuffers GetConsoleCP GetConsoleMode GetCurrentProcessId WriteConsoleW MultiByteToWideChar FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW SetFilePointerEx FormatMessageW GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime EncodePointer CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentThreadId InitializeSListHead RtlUnwind SetEnvironmentVariableW ExitProcess GetModuleHandleExW GetStdHandle HeapAlloc HeapFree GetFileType GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID

advapi32

CloseServiceHandle OpenSCManagerW OpenProcessToken RegGetValueW QueryServiceConfigW OpenServiceW GetTokenInformation QueryServiceStatus

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-11_a6364fe957562295e2016d217df2783a_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat_remcos

PE Signature issue

shell32

shlwapi

oleaut32

ole32

kernel32

advapi32

generic