2026-08-21_a6d168d5d771729d036f36bae71ddfe9_amadey_cobalt-strike_elex_hijackloader_luca-stealer_lynx_njrat

General

Target
2026-08-21_a6d168d5d771729d036f36bae71ddfe9_amadey_cobalt-strike_elex_hijackloader_luca-stealer_lynx_njrat
Size 557KB
Sample260822-klrntaef39
SHA256 928e642d9cde3f4884c82f570e6fd11401fa9b9540c884b6c05df0b35900ff66
MD5 a6d168d5d771729d036f36bae71ddfe9
SHA1 e4e566b4657b1e8e75e53fbfdd4f4e0e49b49fab
SHA512 31b7bf4e57b5339ae6360306c11836145ec97c4cab1170c286ad989e70fb5da5a80f3a1ca893e519aaa1ac1fe345fc5c15d940989a72b1739b4ad5442b52686e
SSDEEP 6144:l9Ae2Way5hWybjlV1VDWiZuAOIOOlsQ9w1icnFrIbvVNybi8cyNBP0FVC5w8ym:lql1y5hNbDlu60nFrIbvVNk1rB+uw8ym
TLSH
T109C47C0065CCF167F23246798B25F16EE5B95A808F1D9FBF87FD0A2A891606F9834353
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-21_a6d168d5d771729d036f36bae71ddfe9_amadey_cobalt-strike_elex_hijackloader_luca-stealer_lynx_njrat

File Explorer

2026-08-21_a6d168d5d771729d036f36bae71ddfe9_amadey_cobalt-strike_elex_hijackloader_luca-stealer_lynx_njrat

.exe 557KB

2026-08-21_a6d168d5d771729d036f36bae71ddfe9_amadey_cobalt-strike_elex_hijackloader_luca-stealer_lynx_njrat

IMPHASH 383ebf01ac19979467e97d3debc83542
SHA256 928e642d9cde3f4884c82f570e6fd11401fa9b9540c884b6c05df0b35900ff66
MD5 a6d168d5d771729d036f36bae71ddfe9
SHA1 e4e566b4657b1e8e75e53fbfdd4f4e0e49b49fab
SHA512 31b7bf4e57b5339ae6360306c11836145ec97c4cab1170c286ad989e70fb5da5a80f3a1ca893e519aaa1ac1fe345fc5c15d940989a72b1739b4ad5442b52686e
SSDEEP 6144:l9Ae2Way5hWybjlV1VDWiZuAOIOOlsQ9w1icnFrIbvVNybi8cyNBP0FVC5w8ym:lql1y5hNbDlu60nFrIbvVNk1rB+uw8ym
TLSH
T109C47C0065CCF167F23246798B25F16EE5B95A808F1D9FBF87FD0A2A891606F9834353
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

61:c0:9a:9f:50:f9:36:93:52:e1:19:a4:17:cd:1b:86:72:c8:63:a7:01:ab:7b:f3:4c:e7:d2:0d:74:34:4d:9e

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=K Desktop Environment e.V.,O=K Desktop Environment e.V.,POSTALCODE=10969,STREET=Prinzenstr 85 F,L=Berlin,ST=Berlin,C=DE

Chains

Apr 27, 2022

CN=K Desktop Environment e.V.,O=K Desktop Environment e.V.,POSTALCODE=10969,STREET=Prinzenstr 85 F,L=Berlin,ST=Berlin,C=DE

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 2, 2018 - Dec 31, 2030

Subject

CN=K Desktop Environment e.V.,O=K Desktop Environment e.V.,POSTALCODE=10969,STREET=Prinzenstr 85 F,L=Berlin,ST=Berlin,C=DE

Serial Number

f0:c2:72:75:d6:86:38:43:79:18:39:2b:6f:79:bb:cc

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 22, 2020 - Jun 22, 2023

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 29, 2022 - Mar 14, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Minor OS version

0

Major OS version

6

Entry point

28636

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WideCharToMultiByte CloseHandle GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress GetStringTypeW GetCPInfo IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcess TerminateProcess CreateFileW RaiseException RtlUnwind GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetCommandLineA GetCommandLineW HeapAlloc HeapFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap HeapSize WriteConsoleW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-21_a6d168d5d771729d036f36bae71ddfe9_amadey_cobalt-strike_elex_hijackloader_luca-stealer_lynx_njrat

PE Signature issue

kernel32

generic