2026-08-23_aeda717dadfe50e9e208f9653ddb3d84_amadey_cobalt-strike_coinminer_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-23_aeda717dadfe50e9e208f9653ddb3d84_amadey_cobalt-strike_coinminer_elex_luca-stealer_lynx_njrat
Size 521KB
Sample260824-bxtg4ssapd
SHA256 6d593125484fa4c5c07711c489c9396ee172262738040d3106b3d9af3ef8dcad
MD5 aeda717dadfe50e9e208f9653ddb3d84
SHA1 c09cb8b143652afde1132593b69298f350d666b0
SHA512 d907aaf7ce5b8bf672bcf6edf52bc27fded4edb835d7f9898487fb3786ba0eba7c44e2c145222dbe98bee953d1b9eb78c41303ce2d8541473a7ec1a504d063d8
SSDEEP 12288:tdrPv6Pcz1/IIIgEw2ZLZAuo/afPHyGVq++45Flx+eWC:76kB/I9Auo/cvCmFlB
TLSH
T174B49D10F8918033C6732871477AE9765C7D6C302E718ACF63C82A796F719D1662AE6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-23_aeda717dadfe50e9e208f9653ddb3d84_amadey_cobalt-strike_coinminer_elex_luca-stealer_lynx_njrat

File Explorer

2026-08-23_aeda717dadfe50e9e208f9653ddb3d84_amadey_cobalt-strike_coinminer_elex_luca-stealer_lynx_njrat

.exe 521KB

2026-08-23_aeda717dadfe50e9e208f9653ddb3d84_amadey_cobalt-strike_coinminer_elex_luca-stealer_lynx_njrat

IMPHASH a1452e423a8330360c3d9d3d16dcd211
SHA256 6d593125484fa4c5c07711c489c9396ee172262738040d3106b3d9af3ef8dcad
MD5 aeda717dadfe50e9e208f9653ddb3d84
SHA1 c09cb8b143652afde1132593b69298f350d666b0
SHA512 d907aaf7ce5b8bf672bcf6edf52bc27fded4edb835d7f9898487fb3786ba0eba7c44e2c145222dbe98bee953d1b9eb78c41303ce2d8541473a7ec1a504d063d8
SSDEEP 12288:tdrPv6Pcz1/IIIgEw2ZLZAuo/afPHyGVq++45Flx+eWC:76kB/I9Auo/cvCmFlB
TLSH
T174B49D10F8918033C6732871477AE9765C7D6C302E718ACF63C82A796F719D1662AE6F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

64:06:c1:77:d4:37:5a:21:5e:d3:2d:ca:e1:77:75:55:df:43:29:12

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Oracle America\, Inc.,OU=Code Signing Bureau,O=Oracle America\, Inc.,L=Redwood Shores,ST=California,C=US

Chains

Jun 22, 2016

CN=Oracle America\, Inc.,OU=Code Signing Bureau,O=Oracle America\, Inc.,L=Redwood Shores,ST=California,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Oracle America\, Inc.,OU=Code Signing Bureau,O=Oracle America\, Inc.,L=Redwood Shores,ST=California,C=US

Serial Number

12:f0:27:7e:0f:23:3b:39:f9:41:9b:06:e8:cd:e3:52

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 14, 2015 - Apr 13, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Minor OS version

Major OS version

Entry point

17068

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\deploy\tmp\javacplexec\obj\javacpl.pdb

user32

LoadStringW wsprintfW MessageBoxW

msvcr100

__dllonexit _lock _onexit _invoke_watson _controlfp_s _except_handler4_common ?_type_info_dtor_internal_method@type_info@@QAEXXZ _crt_debugger_hook __set_app_type _CxxThrowException _fmode _commode __setusermatherr _configthreadlocale _initterm_e _initterm _acmdln exit _ismbblead _XcptFilter _exit _cexit __getmainargs _amsg_exit ?terminate@@YAXXZ memcpy _vsnwprintf_s _ftime64_s wcsftime _snwprintf_s _localtime64 _wputenv fwprintf_s _wdupenv_s free _wfopen_s wcsncpy_s wcscat_s memcpy_s _wsplitpath_s fclose wcscpy_s _wtoi _wstat64i32 memset swprintf_s ??_U@YAPAXI@Z __CxxFrameHandler3 ??3@YAXPAX@Z _stat64i32 ??_V@YAXPAX@Z malloc ??2@YAPAXI@Z _unlock

kernel32

GetProcAddress WideCharToMultiByte lstrlenA MultiByteToWideChar RaiseException GetSystemTimeAsFileTime GetTickCount QueryPerformanceCounter DecodePointer IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess EncodePointer GetStartupInfoW HeapSetInformation InterlockedCompareExchange Sleep InterlockedExchange GetCurrentThreadId GetCurrentProcessId OutputDebugStringW GetLocalTime GetTempPathW GetShortPathNameW LocalAlloc LocalFree GetWindowsDirectoryW lstrlenW WaitForSingleObject CreateProcessW GetSystemDirectoryW CreateFileW GetNativeSystemInfo GetCurrentProcess VerSetConditionMask VerifyVersionInfoW GetVersionExW GlobalMemoryStatusEx InterlockedIncrement GetModuleHandleW GetModuleFileNameW GetLongPathNameW LoadLibraryW GetLastError FreeLibrary CloseHandle InterlockedDecrement FormatMessageW GetEnvironmentVariableW LoadLibraryA

ole32

CoTaskMemFree StringFromCLSID

oleaut32

SysAllocString SysFreeString SysStringLen SysAllocStringByteLen VariantClear

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-23_aeda717dadfe50e9e208f9653ddb3d84_amadey_cobalt-strike_coinminer_elex_luca-stealer_lynx_njrat

PE Signature issue

user32

msvcr100

kernel32

ole32

oleaut32

generic