General
- Target 2026-08-20_a6e05ea5f4f4cc52804964d8ba17af0a_amadey_cobalt-strike_coinminer_darkgate_elex_luca-stealer_lynx_njrat
- Size 494KB
- Sample260821-c4t8na1eld
- SHA256 334d2d0090a607f9b35dde7b139e56419b27d992f34ddea3325c59e2d4de0b9f
- MD5 a6e05ea5f4f4cc52804964d8ba17af0a
- SHA1 7b755b85939915a98f2b87ff270f5017fefe9998
- SHA512 829071fca74eddc1251b2f710e1af69beccd166470000b24b75adc0402b5f2e0f0d56c856dae01a7030a3e8de107d31bcd1897dff3a3298afaebef67e0135db9
- SSDEEP 12288:Q5p1UZ32H10rH5ZVZEsh8ZskmY5a4JNXuOwhDg/K:Q5pOZGHOrH5RLG64JNXQ1m
- TLSH T17AB4CE0E69BA4D37C2BD1ABB05A59381410FB0905082087FF3DDC96BDE166A38BE575F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_a6e05ea5f4f4cc52804964d8ba17af0a_amadey_cobalt-strike_coinminer_darkgate_elex_luca-stealer_lynx_njrat.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_a6e05ea5f4f4cc52804964d8ba17af0a_amadey_cobalt-strike_coinminer_darkgate_elex_luca-stealer_lynx_njrat.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-20_a6e05ea5f4f4cc52804964d8ba17af0a_amadey_cobalt-strike_coinminer_darkgate_elex_luca-stealer_lynx_njrat
- Size 494KB
- SHA256 334d2d0090a607f9b35dde7b139e56419b27d992f34ddea3325c59e2d4de0b9f
- MD5 a6e05ea5f4f4cc52804964d8ba17af0a
- SHA1 7b755b85939915a98f2b87ff270f5017fefe9998
- SHA512 829071fca74eddc1251b2f710e1af69beccd166470000b24b75adc0402b5f2e0f0d56c856dae01a7030a3e8de107d31bcd1897dff3a3298afaebef67e0135db9
- SSDEEP 12288:Q5p1UZ32H10rH5ZVZEsh8ZskmY5a4JNXuOwhDg/K:Q5pOZGHOrH5RLG64JNXQ1m
- TLSH T17AB4CE0E69BA4D37C2BD1ABB05A59381410FB0905082087FF3DDC96BDE166A38BE575F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects Rhadamanthys Payload
-
Family: Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess