2026-08-13_a621a59a722ac118b9287a3ad3116b80_amadey_elex_floxif_luca-stealer_lynx_medusalocker_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-13_a621a59a722ac118b9287a3ad3116b80_amadey_elex_floxif_luca-stealer_lynx_medusalocker_njrat
Size 2.6MB
Sample260813-t3hlxacm21
SHA256 3aeded7ebf23eb8304f7603a8a01b80eff7795cefa2d0c92a358767fddce72e1
MD5 a621a59a722ac118b9287a3ad3116b80
SHA1 f4c647a19cb466bb3b42f5df62f03d0e625a9e54
SHA512 3ffa6c66f9c35d3f4856854b9788669bd0cb47e5acd34131233179a1f4af36adae889726fa223a8d095878efd7b754e7e2af8ea37765ccc30481b75eb0c8cbff
SSDEEP 24576:5MxKfKOI8FDrELRTwPsosMqlSGCg1AKxFPme0wd/ZL8Ug+JwNZgCxiIsCA2flywm:/yOnDr88gSGJRTPme0wxZN2DxiIq2dOp
TLSH
T199C55C21A2D54125F5F3AA312D7DB3EA0A76BC256E75C18F3298763C0B72AC09D31736
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-13_a621a59a722ac118b9287a3ad3116b80_amadey_elex_floxif_luca-stealer_lynx_medusalocker_njrat

File Explorer

2026-08-13_a621a59a722ac118b9287a3ad3116b80_amadey_elex_floxif_luca-stealer_lynx_medusalocker_njrat

.exe 2.6MB

2026-08-13_a621a59a722ac118b9287a3ad3116b80_amadey_elex_floxif_luca-stealer_lynx_medusalocker_njrat

IMPHASH d3c026afe97504ed51e97e42c40d0c29
SHA256 3aeded7ebf23eb8304f7603a8a01b80eff7795cefa2d0c92a358767fddce72e1
MD5 a621a59a722ac118b9287a3ad3116b80
SHA1 f4c647a19cb466bb3b42f5df62f03d0e625a9e54
SHA512 3ffa6c66f9c35d3f4856854b9788669bd0cb47e5acd34131233179a1f4af36adae889726fa223a8d095878efd7b754e7e2af8ea37765ccc30481b75eb0c8cbff
SSDEEP 24576:5MxKfKOI8FDrELRTwPsosMqlSGCg1AKxFPme0wd/ZL8Ug+JwNZgCxiIsCA2flywm:/yOnDr88gSGJRTPme0wxZN2DxiIq2dOp
TLSH
T199C55C21A2D54125F5F3AA312D7DB3EA0A76BC256E75C18F3298763C0B72AC09D31736
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

98:3f:ed:a0:76:48:92:21:89:fb:8c:6a:ee:2c:4f:dd:d8:c3:65:45:b2:85:9d:10:d4:42:3f:8d:fe:36:55:62

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Malwarebytes Inc,O=Malwarebytes Inc,L=Santa Clara,ST=CA,C=US

Chains

Oct 7, 2022

CN=Malwarebytes Inc,O=Malwarebytes Inc,L=Santa Clara,ST=CA,C=US

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

PE Signature issue

Digest

98:3f:ed:a0:76:48:92:21:89:fb:8c:6a:ee:2c:4f:dd:d8:c3:65:45:b2:85:9d:10:d4:42:3f:8d:fe:36:55:62

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Malwarebytes Inc.,O=Malwarebytes Inc.,ST=California,C=US

Chains

Oct 7, 2022

CN=Malwarebytes Inc.,O=Malwarebytes Inc.,ST=California,C=US

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=Malwarebytes Inc.,O=Malwarebytes Inc.,ST=California,C=US

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 12, 2019 - Dec 31, 2028

Subject

CN=Malwarebytes Inc.,O=Malwarebytes Inc.,ST=California,C=US

Serial Number

a6:57:f7:78:b3:1a:e5:23:d6:67:13:17:18:d1:6e:b2

Issuer

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 16, 2025

Subject

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Serial Number

9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - May 24, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=Thales TSS ESN:3DA5-963B-E1F4,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:1e:13:57:da:40:37:cd:fc:82:00:00:00:00:00:1e

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 7, 2022 - Jul 7, 2023

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Malwarebytes Inc,O=Malwarebytes Inc,L=Santa Clara,ST=CA,C=US

Serial Number

33:00:00:36:b6:df:f2:85:50:91:46:49:53:00:00:00:00:36:b6

Issuer

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 7, 2022 - Oct 10, 2022

Subject

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:37:8c:5b:a1:d9:5b:8c:d4:00:00:00:00:00:07

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 13, 2021 - Apr 13, 2026

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Minor OS version

Major OS version

Entry point

441463

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\jenkins\workspace\A_MB4_MBSetup\bin\Win32\Release\MBSetup.pdb

kernel32

GetProcAddress GetModuleHandleW lstrcmpiW LeaveCriticalSection RaiseException EnterCriticalSection GetLastError MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW InitializeCriticalSectionEx DeleteCriticalSection WideCharToMultiByte GetCurrentThreadId SetLastError LockResource FindResourceExW Sleep GlobalFree LocalFree FormatMessageW LocalAlloc CallNamedPipeW DecodePointer CreateMutexW GetNativeSystemInfo GetCommandLineW GetDiskFreeSpaceExW GetWindowsDirectoryW FreeLibrary FindClose GetSystemDirectoryW CreateProcessW VerifyVersionInfoW VerSetConditionMask GetCurrentProcess FindNextFileW CloseHandle GlobalAlloc GlobalLock SetThreadUILanguage LoadLibraryW CreateDirectoryW GetLogicalDrives GetTempPathW CreateFileW InitializeProcThreadAttributeList UpdateProcThreadAttribute DeleteProcThreadAttributeList OpenProcess ResumeThread TerminateProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetModuleFileNameExW GetCurrentDirectoryW GetCurrentProcessId OutputDebugStringW SetEndOfFile GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy FindFirstFileW MulDiv WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA GetStringTypeW DeleteFileW FindFirstFileExW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle RemoveDirectoryW AreFileApisANSI CopyFileW DuplicateHandle WaitForSingleObjectEx SwitchToThread GetCurrentThread QueryPerformanceCounter TryEnterCriticalSection EncodePointer InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo IsDebuggerPresent InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree SetEvent ResetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA GetVersionExW ReleaseSemaphore InterlockedFlushSList QueryDepthSList UnregisterWaitEx RtlUnwind ExitProcess GetModuleHandleExW ExitThread GetStdHandle WriteFile GetFileType FlushFileBuffers GetConsoleCP GetConsoleMode ReadFile SetFilePointerEx GetFileSizeEx ReadConsoleW GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW

crypt32

CertCloseStore CertFreeCertificateContext CertGetNameStringW CertFindCertificateInStore CryptMsgGetParam CryptQueryObject CryptMsgClose

rpcrt4

UuidCreate UuidToStringW RpcStringFreeW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-13_a621a59a722ac118b9287a3ad3116b80_amadey_elex_floxif_luca-stealer_lynx_medusalocker_njrat

PE Signature issue

PE Signature issue

kernel32

crypt32

rpcrt4

generic