2026-09-16_3c7842dabded6e99fc858b8b524a26a7_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-16_3c7842dabded6e99fc858b8b524a26a7_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat
Size 991KB
Sample260916-qfkk7s1cpg
SHA256 116f430387b4ca8c2fc4ff2d3eccb910e8cbacec4e588e41f525db7f9825dd3c
MD5 3c7842dabded6e99fc858b8b524a26a7
SHA1 07b78aec3023432a911344d94645e279f531ab24
SHA512 dc90a3e40506f9bd104842f942c454522db1345a44b6ccd41630f74b31d7048b09c1d9ee587f12f1da43790085c03e69b20e52b9fb4e54650989575153a3eb9d
SSDEEP 12288:y3syEiQF/a8ZBC4TZfgeRrnsd6LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf5D:y3s1iAaqTZYUsTNyBo4kx929bL3Hnx
TLSH
T17325D0117295C032D47216319A29DBF58A7DBD208F6656DFA7C03E3EBD302C2AA31B57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-16_3c7842dabded6e99fc858b8b524a26a7_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

File Explorer

2026-09-16_3c7842dabded6e99fc858b8b524a26a7_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

.exe 991KB

2026-09-16_3c7842dabded6e99fc858b8b524a26a7_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

IMPHASH fe967d2cce51542da71ada85c8ce6681
SHA256 116f430387b4ca8c2fc4ff2d3eccb910e8cbacec4e588e41f525db7f9825dd3c
MD5 3c7842dabded6e99fc858b8b524a26a7
SHA1 07b78aec3023432a911344d94645e279f531ab24
SHA512 dc90a3e40506f9bd104842f942c454522db1345a44b6ccd41630f74b31d7048b09c1d9ee587f12f1da43790085c03e69b20e52b9fb4e54650989575153a3eb9d
SSDEEP 12288:y3syEiQF/a8ZBC4TZfgeRrnsd6LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf5D:y3s1iAaqTZYUsTNyBo4kx929bL3Hnx
TLSH
T17325D0117295C032D47216319A29DBF58A7DBD208F6656DFA7C03E3EBD302C2AA31B57
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

95296

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\workspace\ccd-app\nightly_build\build\msvs_win32_x86\Release\x86\sym\CreativeCloudRedirector\CreativeCloudRedirector\Creative Cloud.pdb

kernel32

GetModuleFileNameW WriteConsoleW SetEndOfFile GetConsoleOutputCP SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetCurrentProcessId FindFirstFileW FindNextFileW WriteFile SetFilePointer GetTempPathW CreateFileW GetCurrentThreadId GetLastError DeleteFileW CloseHandle lstrcmpW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection ReadFile GetFileSizeEx FindClose GetFileAttributesW SetFileAttributesW LocalFree MoveFileExW FlushFileBuffers HeapFree SetLastError GetCurrentProcess TerminateProcess InitializeCriticalSectionEx WaitForSingleObject HeapSize CreateEventW SetEvent HeapReAlloc ResetEvent HeapAlloc DecodePointer GetProcAddress GetProcessHeap CreateProcessW GetModuleHandleW MultiByteToWideChar FileTimeToSystemTime GetLocalTime GetTimeFormatW SystemTimeToFileTime WideCharToMultiByte GetDateFormatW CreateMutexW ReleaseMutex OpenMutexW GetFileInformationByHandle GetVersionExW VerSetConditionMask VerifyVersionInfoW GetUserDefaultLangID FreeLibrary GetUserDefaultUILanguage LCMapStringW GetUserDefaultLCID GetStringTypeW EncodePointer LCMapStringEx GetCPInfo InitializeCriticalSectionAndSpinCount WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW RaiseException RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetTimeZoneInformation ExitProcess GetModuleHandleExW GetStdHandle GetFileType CompareStringW GetLocaleInfoW IsValidLocale EnumSystemLocalesW GetConsoleMode ReadConsoleW SetFilePointerEx

shell32

SHCreateDirectoryExW SHGetSpecialFolderPathW CommandLineToArgvW

ole32

CoUninitialize CoInitialize

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

shlwapi

PathIsFileSpecW PathRenameExtensionW PathRemoveExtensionW PathFileExistsW PathIsDirectoryW PathFindFileNameW PathAppendW PathRemoveFileSpecW PathAddExtensionW

user32

AllowSetForegroundWindow

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW

oleaut32

VariantClear

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_3c7842dabded6e99fc858b8b524a26a7_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

kernel32

shell32

ole32

version

shlwapi

user32

advapi32

oleaut32

generic