2026-08-11_0c6347145e9328916608196d9443042c_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-11_0c6347145e9328916608196d9443042c_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat
Size 954KB
Sample260811-egf4macd32
SHA256 029e2b0c4e5764ae9decd4119b6afd6fdf6a3d5024da19b7382b6f5713dbc2af
MD5 0c6347145e9328916608196d9443042c
SHA1 321853d8d704363a06d34f45dcf6f39b32196d9d
SHA512 0ba0f1f724349c5594395a5a53d65a959449a535a8e67f443e2f15389d022d49a70b74936a1750eb3b42aa55deed10d150ee37616c48964f688b1eb1e8761e5e
SSDEEP 6144:EfiWyMRSLj2BbdTlbEVv3zZ8O73Z8PFMbObAO7XTBEiHQIKB:EiWyMlfQVvZ4FplXT/wpB
TLSH
T1BD251731B1B5CA32D46635318A679AF1666EFD20CFA146CF33843E6A79302C0F935B56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-11_0c6347145e9328916608196d9443042c_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

File Explorer

2026-08-11_0c6347145e9328916608196d9443042c_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

.exe 954KB

2026-08-11_0c6347145e9328916608196d9443042c_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

IMPHASH bb6444833902d979ea0198ea9081a902
SHA256 029e2b0c4e5764ae9decd4119b6afd6fdf6a3d5024da19b7382b6f5713dbc2af
MD5 0c6347145e9328916608196d9443042c
SHA1 321853d8d704363a06d34f45dcf6f39b32196d9d
SHA512 0ba0f1f724349c5594395a5a53d65a959449a535a8e67f443e2f15389d022d49a70b74936a1750eb3b42aa55deed10d150ee37616c48964f688b1eb1e8761e5e
SSDEEP 6144:EfiWyMRSLj2BbdTlbEVv3zZ8O73Z8PFMbObAO7XTBEiHQIKB:EiWyMlfQVvZ4FplXT/wpB
TLSH
T1BD251731B1B5CA32D46635318A679AF1666EFD20CFA146CF33843E6A79302C0F935B56
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

105456

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\workspace\ccd-app\nightly_build\build\msvs_win32_x86\Release\x86\sym\ElevationManagerCustomHook\ElevationManagerCustomHook\AdobeServiceInstaller.pdb

kernel32

GetProcessHeap HeapAlloc GetTickCount GetCurrentProcessId QueryPerformanceFrequency Sleep HeapFree VerifyVersionInfoW FreeLibrary VerSetConditionMask GetProcAddress CloseHandle GetLastError WriteConsoleW SetEndOfFile SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindFirstFileExW ReadConsoleW EnumSystemLocalesW IsValidLocale ReadFile FindFirstFileW GetFileSizeEx FindNextFileW WriteFile GetModuleFileNameW GetTempPathW FindClose LocalAlloc CreateFileW GetFileAttributesW SetFileAttributesW DeleteFileW LocalFree MoveFileExW lstrcmpW FlushFileBuffers InitializeCriticalSectionEx MultiByteToWideChar DecodePointer DeleteCriticalSection WideCharToMultiByte SetFilePointer GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GetVersionExW CreateEventW GetModuleHandleW GetFileInformationByHandle FileTimeToSystemTime GetLocalTime GetTimeFormatW SystemTimeToFileTime GetDateFormatW CreateMutexW WaitForSingleObject ReleaseMutex OpenMutexW SetLastError TerminateProcess HeapSize SetEvent HeapReAlloc ResetEvent GetUserDefaultLangID GetUserDefaultUILanguage LCMapStringW GetUserDefaultLCID GetStringTypeW EncodePointer LCMapStringEx GetCPInfo InitializeCriticalSectionAndSpinCount WaitForSingleObjectEx InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime IsDebuggerPresent GetStartupInfoW OutputDebugStringW RaiseException RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetTimeZoneInformation GetStdHandle ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetFileType SetFilePointerEx GetConsoleOutputCP GetConsoleMode CompareStringW GetLocaleInfoW GetCurrentProcess

advapi32

RegQueryValueExW RegOpenKeyExW QueryServiceStatusEx OpenServiceW StartServiceW EnumDependentServicesW ControlService DeleteService OpenSCManagerW CloseServiceHandle CreateServiceW RegCloseKey

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

crypt32

CertGetNameStringW

wintrust

WinVerifyTrust WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData WTHelperGetProvCertFromChain

shlwapi

PathIsDirectoryW PathAppendW PathAddExtensionW PathIsFileSpecW PathFindFileNameW PathRemoveFileSpecW PathFileExistsW PathRenameExtensionW PathRemoveExtensionW

shell32

SHCreateDirectoryExW SHGetSpecialFolderPathW

oleaut32

VariantClear

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-11_0c6347145e9328916608196d9443042c_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

kernel32

advapi32

version

crypt32

wintrust

shlwapi

shell32

oleaut32

generic