2026-08-15_e549e1f63ce4f2b24a52abec8d1d1b22_amadey_elex_floxif_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-15_e549e1f63ce4f2b24a52abec8d1d1b22_amadey_elex_floxif_luca-stealer_lynx_njrat
Size 3.3MB
Sample260815-19yp2avyft
SHA256 93ea49099d2a4cbb38e86b7bacb2587d3c620bfffc1536ab754c708857442aec
MD5 e549e1f63ce4f2b24a52abec8d1d1b22
SHA1 e3c0c0f63c42ce46d0388d2981212c3f3b4100a9
SHA512 5724a2ce2b3ed89f8a724638ba1f2ee42c3e4d2e64ac7fbbe74e1af4dd681f8331c61f6d23aa0deb603a1ad660b006e9239ba4daac3f7bed49b6c82c5209efdb
SSDEEP 98304:YiDj+Tq+iml9s+qgI8Ynaba6UcEM08kAAf:XDiTtiml9s+qgIAFAf
TLSH
T11CF5F62173E98125F1B327B0A93D9A664A7EBC715F31C1DF72902E1D19B0AC19A31B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-15_e549e1f63ce4f2b24a52abec8d1d1b22_amadey_elex_floxif_luca-stealer_lynx_njrat

File Explorer

2026-08-15_e549e1f63ce4f2b24a52abec8d1d1b22_amadey_elex_floxif_luca-stealer_lynx_njrat

.exe 3.3MB

2026-08-15_e549e1f63ce4f2b24a52abec8d1d1b22_amadey_elex_floxif_luca-stealer_lynx_njrat

IMPHASH 68d199a53b8ea29dd66595453b21d6e1
SHA256 93ea49099d2a4cbb38e86b7bacb2587d3c620bfffc1536ab754c708857442aec
MD5 e549e1f63ce4f2b24a52abec8d1d1b22
SHA1 e3c0c0f63c42ce46d0388d2981212c3f3b4100a9
SHA512 5724a2ce2b3ed89f8a724638ba1f2ee42c3e4d2e64ac7fbbe74e1af4dd681f8331c61f6d23aa0deb603a1ad660b006e9239ba4daac3f7bed49b6c82c5209efdb
SSDEEP 98304:YiDj+Tq+iml9s+qgI8Ynaba6UcEM08kAAf:XDiTtiml9s+qgIAFAf
TLSH
T11CF5F62173E98125F1B327B0A93D9A664A7EBC715F31C1DF72902E1D19B0AC19A31B37
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

a9:94:ed:d9:e7:96:de:c8:bf:6b:d8:69:a0:ea:5d:03:ac:c8:4d:b8:44:ee:e4:20:8a:cc:a0:24:b6:29:5f:01

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jun 5, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

07:4f:bf:17:05:09:33:a4:1c:8d:93:c8:7b:aa:2a:b1

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 6, 2025 - Oct 5, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1664896

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\workspace\ccd-app\nightly_build\build\msvs_win32_x86\Release\x86\sym\LBS\LBS\CreativeCloudSet-Up.pdb

comctl32

ord17

gdi32

GetDeviceCaps

bcrypt

BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptOpenAlgorithmProvider BCryptEncrypt BCryptHashData BCryptDecrypt BCryptCreateHash BCryptDestroyKey BCryptGenerateSymmetricKey BCryptGetProperty BCryptSetProperty

kernel32

LoadResource FindResourceW GetProcAddress FreeLibrary SetDllDirectoryW SetLastError GetProcessId CreateMutexW WaitForSingleObject ReleaseMutex lstrcmpiW GetExitCodeProcess GetModuleHandleW FindFirstFileW FindNextFileW TerminateProcess RemoveDirectoryW GetModuleFileNameW GetTempPathW FindClose SetFileAttributesW CreateToolhelp32Snapshot MultiByteToWideChar Sleep Process32NextW DeleteFileW Process32FirstW CreateProcessW CopyFileW WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSection ResumeThread SetEvent TerminateThread CreateThread IsDebuggerPresent GetLocaleInfoA EnumSystemLocalesW GetUserDefaultLangID GetUserDefaultUILanguage GetACP IsDBCSLeadByteEx FormatMessageW LocalFree HeapFree LocalAlloc CreateEventW GetCurrentThread GlobalFree HeapAlloc GetProcessHeap CreateDirectoryW ReadFile GetFileSizeEx DeviceIoControl GetFileAttributesW MoveFileExW lstrcmpW FlushFileBuffers CreateNamedPipeW ConnectNamedPipe SetFilePointer GetCurrentThreadId GetPhysicallyInstalledSystemMemory HeapSize ProcessIdToSessionId HeapReAlloc ResetEvent GetFileInformationByHandle ReleaseSemaphore OpenSemaphoreW CreateSemaphoreW FileTimeToSystemTime GetLocalTime GetTimeFormatW SystemTimeToFileTime GetDateFormatW OpenMutexW GetStdHandle WaitForMultipleObjects LoadLibraryA LCMapStringW LCMapStringA GetUserDefaultLCID GetStringTypeExA CreateThreadpool CloseThreadpool CreateThreadpoolCleanupGroup CloseThreadpoolCleanupGroupMembers CloseThreadpoolCleanupGroup CreateThreadpoolTimer SetThreadpoolTimer CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetUserDefaultLocaleName GetVersion FreeConsole QueryPerformanceFrequency GetNativeSystemInfo IsWow64Process GetProcessTimes K32GetProcessMemoryInfo FormatMessageA GetEnvironmentVariableW GetFileAttributesExW GetFileTime SetEndOfFile SetFilePointerEx GetWindowsDirectoryW CreateDirectoryExW AreFileApisANSI GetSystemTimeAsFileTime SetThreadPriority InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryEnterCriticalSection GetStringTypeW GetLocaleInfoEx InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW QueryPerformanceCounter InitOnceBeginInitialize InitOnceComplete RaiseException WaitForSingleObjectEx GetExitCodeThread EncodePointer LCMapStringEx CompareStringEx GetCPInfo OutputDebugStringW GetConsoleOutputCP IsValidLocale GetLocaleInfoW CompareStringW FreeLibraryAndExitThread ExitThread GetModuleHandleExW ExitProcess GetFileType SetStdHandle LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind GetStartupInfoW InitializeSListHead InitializeCriticalSectionAndSpinCount IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter LockResource GetSystemDirectoryW CreateFileW SizeofResource VerifyVersionInfoW VerSetConditionMask CloseHandle OpenProcess GetCurrentProcess GetSystemTime GetCurrentProcessId DeleteCriticalSection DecodePointer GetSystemInfo GetLastError GetVersionExW InitializeCriticalSectionEx GetConsoleMode ReadConsoleW FindFirstFileExW IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW VirtualProtect VirtualQuery LoadLibraryExA lstrlenW VirtualFree VirtualAlloc LoadLibraryW GlobalMemoryStatusEx WriteFile GetTimeZoneInformation

user32

LoadStringA GetWindowTextLengthW PostMessageW SendMessageW EndDialog SetWindowTextW GetSystemMenu GetDC MessageBoxW GetSystemMetrics GetClassNameW EnumWindows SetWindowPos DestroyWindow GetWindow CreateDialogParamW ShowWindow GetDlgItemTextW SendDlgItemMessageW BringWindowToTop ChangeWindowMessageFilterEx GetDlgItem EnableMenuItem DialogBoxParamW SetForegroundWindow LoadImageW ReleaseDC EnableWindow GetWindowThreadProcessId AllowSetForegroundWindow

advapi32

CryptAcquireContextW CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext CreateWellKnownSid SetNamedSecurityInfoW GetNamedSecurityInfoW SetSecurityDescriptorDacl AllocateAndInitializeSid SetEntriesInAclW RegCreateKeyExW RegSetValueExW FreeSid InitializeSecurityDescriptor LookupAccountSidW RegQueryValueExW RegCloseKey RegQueryValueExA RegOpenKeyExW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken GetUserNameW ImpersonateLoggedOnUser ConvertStringSidToSidW RevertToSelf RegGetValueW

ole32

CoInitializeEx StringFromGUID2 CoUninitialize CoInitialize CoCreateInstance CoTaskMemFree CoSetProxyBlanket CoCreateGuid CLSIDFromProgID OleRun CLSIDFromString

shell32

SHCreateDirectoryExW ShellExecuteW ShellExecuteExW SHGetKnownFolderPath SHGetPathFromIDListW SHGetFolderLocation SHGetDiskFreeSpaceExW ord680 SHGetFolderPathW SHGetSpecialFolderPathW CommandLineToArgvW

oleaut32

GetErrorInfo VariantCopy VariantInit SysAllocString SysStringLen VariantChangeType VariantClear SysFreeString

shlwapi

PathAddExtensionW PathIsFileSpecW PathRenameExtensionW PathRemoveExtensionW SHGetValueW PathFileExistsW PathRemoveFileSpecW PathIsDirectoryW PathIsNetworkPathW PathFindFileNameW PathIsRootW PathAppendW PathIsSystemFolderW

crypt32

CertGetIssuerCertificateFromStore CertGetNameStringW

wintrust

WTHelperProvDataFromStateData WinVerifyTrust WTHelperGetProvSignerFromChain WTHelperGetProvCertFromChain

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

504KB

Virtual Size

503KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

44KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

668KB

Virtual Size

667KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

108KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-15_e549e1f63ce4f2b24a52abec8d1d1b22_amadey_elex_floxif_luca-stealer_lynx_njrat

PE Signature issue

comctl32

gdi32

bcrypt

kernel32

user32

advapi32

ole32

shell32

oleaut32

shlwapi

crypt32

wintrust

generic