General
- Target 2026-08-21_a6d168d5d771729d036f36bae71ddfe9_amadey_cobalt-strike_elex_hijackloader_luca-stealer_lynx_njrat
- Size 557KB
- Sample260822-klrntaef39
- SHA256 928e642d9cde3f4884c82f570e6fd11401fa9b9540c884b6c05df0b35900ff66
- MD5 a6d168d5d771729d036f36bae71ddfe9
- SHA1 e4e566b4657b1e8e75e53fbfdd4f4e0e49b49fab
- SHA512 31b7bf4e57b5339ae6360306c11836145ec97c4cab1170c286ad989e70fb5da5a80f3a1ca893e519aaa1ac1fe345fc5c15d940989a72b1739b4ad5442b52686e
- SSDEEP 6144:l9Ae2Way5hWybjlV1VDWiZuAOIOOlsQ9w1icnFrIbvVNybi8cyNBP0FVC5w8ym:lql1y5hNbDlu60nFrIbvVNk1rB+uw8ym
- TLSH T109C47C0065CCF167F23246798B25F16EE5B95A808F1D9FBF87FD0A2A891606F9834353
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-21_a6d168d5d771729d036f36bae71ddfe9_amadey_cobalt-strike_elex_hijackloader_luca-stealer_lynx_njrat.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-21_a6d168d5d771729d036f36bae71ddfe9_amadey_cobalt-strike_elex_hijackloader_luca-stealer_lynx_njrat.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-21_a6d168d5d771729d036f36bae71ddfe9_amadey_cobalt-strike_elex_hijackloader_luca-stealer_lynx_njrat
- Size 557KB
- SHA256 928e642d9cde3f4884c82f570e6fd11401fa9b9540c884b6c05df0b35900ff66
- MD5 a6d168d5d771729d036f36bae71ddfe9
- SHA1 e4e566b4657b1e8e75e53fbfdd4f4e0e49b49fab
- SHA512 31b7bf4e57b5339ae6360306c11836145ec97c4cab1170c286ad989e70fb5da5a80f3a1ca893e519aaa1ac1fe345fc5c15d940989a72b1739b4ad5442b52686e
- SSDEEP 6144:l9Ae2Way5hWybjlV1VDWiZuAOIOOlsQ9w1icnFrIbvVNybi8cyNBP0FVC5w8ym:lql1y5hNbDlu60nFrIbvVNk1rB+uw8ym
- TLSH T109C47C0065CCF167F23246798B25F16EE5B95A808F1D9FBF87FD0A2A891606F9834353
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Family: RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Detects executables packed with ConfuserEx Mod
-
Suspicious use of SetThreadContext