Extracted

Extracted

Extracted

• • Target
    2026-08-30_3c435ce3d58f8a8c01dc4c68c749c559_amadey_cobalt-strike_elex_lynx_smoke-loader
  • Size 145KB
  • SHA256 8d793a16bf2e7153df21e2ede4b0baf6e080596073b27ecbeac6613b6a68b8d8
  • MD5 3c435ce3d58f8a8c01dc4c68c749c559
  • SHA1 17808ce133d05073439b0253eab8ad7292a491d4
  • SHA512 71691a7584a139699da7c6ec38505d74542da6cd4cf0051f41ca4f6de8aa202a34ce9c58342bf4d75cc44bc705af8ea2cadc4b5f62efac0a57259e43edd1f529
  • SSDEEP 3072:vzp+KYjQ9pTL20Hng9Xd2qXXNCq7rsor0BJUzt7UrqYmZeOf9HyH59bI5LOFN+0k:vzp+09pT7ng9Xd2qXXNCq7rsor0BJUzz
  • TLSH
    T105E39E117593C0B2D07209350864BBA58A7D7D203BA1ADBB77E81A2E1F703E4A673D77
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionamadeyremus_stealerinstallerpersistencespywarestealertrojanbotnetdefense_evasionsocks5systemzrevoked_codesignupx

  • Detect Socks5Systemz Payload

  • Detects Amadey x86-bit Payload

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Family: Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Detects encrypted or obfuscated .NET executables

  • UPX dump on OEP (original entry point)

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Downloads MZ/PE file

  • Signed with revoked ConnectWise certificate

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2