2026-09-16_f54f1aae58394cdfe9e960e50d409d2c_akira_amadey_cobalt-strike_conti_elex_floxif_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-16_f54f1aae58394cdfe9e960e50d409d2c_akira_amadey_cobalt-strike_conti_elex_floxif_luca-stealer_lynx_njrat
Size 690KB
Sample260916-ssaymsscmd
SHA256 12436c1cc8c5068eb255d3da39d11cf93997f64b5289d134217632fdfa019e6f
MD5 f54f1aae58394cdfe9e960e50d409d2c
SHA1 49b1fe5396df4fa66cb09ec0d9231bdd4e67c581
SHA512 721afd554c6b97c48988810dd1a573b022d17559df4c032b8475e85471013a34292102bbade171669e4b1d6c09d3b03ed970303150ff216655add2ca6a5c06aa
SSDEEP 12288:yV76fbCDwCarklYF9vQaSTb0uGSEeUyzUMkRs5XdAFknu39Um2BjvrEH7ug:qYCWrpv5STpGA5zUMxhiLUmgrEH7ug
TLSH
T1D8E4D000764193F7D563003235689B72E9BDA8390B750DEFA7D41D28CEB86C1B635FAA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-16_f54f1aae58394cdfe9e960e50d409d2c_akira_amadey_cobalt-strike_conti_elex_floxif_luca-stealer_lynx_njrat

File Explorer

2026-09-16_f54f1aae58394cdfe9e960e50d409d2c_akira_amadey_cobalt-strike_conti_elex_floxif_luca-stealer_lynx_njrat

.exe 690KB

2026-09-16_f54f1aae58394cdfe9e960e50d409d2c_akira_amadey_cobalt-strike_conti_elex_floxif_luca-stealer_lynx_njrat

IMPHASH aa1a3905a5868e732337449a47bbec59
SHA256 12436c1cc8c5068eb255d3da39d11cf93997f64b5289d134217632fdfa019e6f
MD5 f54f1aae58394cdfe9e960e50d409d2c
SHA1 49b1fe5396df4fa66cb09ec0d9231bdd4e67c581
SHA512 721afd554c6b97c48988810dd1a573b022d17559df4c032b8475e85471013a34292102bbade171669e4b1d6c09d3b03ed970303150ff216655add2ca6a5c06aa
SSDEEP 12288:yV76fbCDwCarklYF9vQaSTb0uGSEeUyzUMkRs5XdAFknu39Um2BjvrEH7ug:qYCWrpv5STpGA5zUMxhiLUmgrEH7ug
TLSH
T1D8E4D000764193F7D563003235689B72E9BDA8390B750DEFA7D41D28CEB86C1B635FAA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

20:fe:74:b6:a2:6b:c2:1f:1a:41:33:45:76:87:11:90:59:27:6b:09:21:88:df:95:1b:ec:6e:d6:fb:59:8d:75

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=CrystalBit Solutions,O=CrystalBit Solutions,ST=West-Vlaanderen,C=BE

Chains

Aug 7, 2023

CN=CrystalBit Solutions,O=CrystalBit Solutions,ST=West-Vlaanderen,C=BE

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=CrystalBit Solutions,O=CrystalBit Solutions,ST=West-Vlaanderen,C=BE

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

PE Signature issue

Digest

a5:32:16:0f:15:7d:3f:1a:9f:3d:61:3e:f5:4c:60:fe:c5:de:6e:ec

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=CrystalBit Solutions,O=CrystalBit Solutions,ST=West-Vlaanderen,C=BE

Chains

Aug 7, 2023

CN=CrystalBit Solutions,O=CrystalBit Solutions,ST=West-Vlaanderen,C=BE

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=CrystalBit Solutions,O=CrystalBit Solutions,ST=West-Vlaanderen,C=BE

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,ST=West-Vlaanderen,C=BE

Serial Number

df:0f:fa:00:a5:0c:fa:4e:38:9f:6b:7f:4d:93:2d:4f

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 10, 2023 - Jul 9, 2026

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 3, 2023 - Aug 2, 2034

Minor OS version

Major OS version

Entry point

473071

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

MultiByteToWideChar WideCharToMultiByte CreateFileW FindClose FindNextFileW GetFileAttributesW WriteFile GetLastError GetModuleHandleW LocalFree GetCommandLineW IsDebuggerPresent DebugBreak OutputDebugStringW SetLastError HeapAlloc HeapFree GetProcessHeap EnterCriticalSection LeaveCriticalSection ReleaseSemaphore ReleaseMutex WaitForSingleObjectEx OpenSemaphoreW CreateMutexExW CreateSemaphoreExW GetCurrentProcess GetCurrentProcessId TerminateProcess GetCurrentThreadId GetModuleFileNameA GetModuleFileNameW GetModuleHandleExW FormatMessageW FreeLibrary CreateEventW DeleteCriticalSection IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount ResetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter QueryPerformanceCounter InitializeSListHead GetStartupInfoW RaiseException RtlUnwind EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetStdHandle ExitProcess LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetFileSizeEx SetFilePointerEx GetConsoleMode GetConsoleOutputCP HeapReAlloc FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW FlushFileBuffers HeapSize WriteConsoleW DecodePointer FileTimeToDosDateTime GetProcAddress MapViewOfFile CreateFileMappingW GetSystemTimeAsFileTime OpenEventW OpenMutexW WaitForSingleObject SetEvent CloseHandle FileTimeToLocalFileTime InitializeCriticalSectionEx

user32

MessageBoxA CharLowerBuffW

advapi32

RegCloseKey RegCreateKeyExA RegCreateKeyExW RegOpenKeyExA RegOpenKeyExW RegQueryValueExA RegQueryValueExW RegSetValueExA RegSetValueExW

shell32

CommandLineToArgvW

Name

.text

Size

220KB

Virtual Size

220KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

j8gtjyye

Size

67KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

4KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

e2ps0tu0

Size

291KB

Virtual Size

292KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

rvyi4dp5

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_f54f1aae58394cdfe9e960e50d409d2c_akira_amadey_cobalt-strike_conti_elex_floxif_luca-stealer_lynx_njrat

PE Signature issue

PE Signature issue

kernel32

user32

advapi32

shell32

generic