2026-09-16_e8a42541eb4414e42ca955926451ef67_amadey_cobalt-strike_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-16_e8a42541eb4414e42ca955926451ef67_amadey_cobalt-strike_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_njrat_smoke-loader
Size 868KB
Sample260916-tcwe3sseqd
SHA256 75d24940ab6811e93e16dbe538c398629275d4a9195b9dcf0b2ef525aeb34177
MD5 e8a42541eb4414e42ca955926451ef67
SHA1 c52a974565d618e594af23ec60fe9c56f50da3dc
SHA512 f3018e3318cbb84db804bbf64f37a2548454df251391236ea3fdee82670be69890b01a854e1b3fbf7c6177289b285f7d546a1a802793a814e590d006adfc3ff4
SSDEEP 24576:D6o49O7R28ZRHurMNwGJ5GvIqVSt9SzsrEH7p+:eZoLw2GvIq4tAp+
TLSH
T1D615AE61B841D173E1D10072B6BD5FB28C6C683C0B2558E3E7D40A799AB81E37A79B1F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-16_e8a42541eb4414e42ca955926451ef67_amadey_cobalt-strike_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_njrat_smoke-loader

File Explorer

2026-09-16_e8a42541eb4414e42ca955926451ef67_amadey_cobalt-strike_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_njrat_smoke-loader

.exe 868KB

2026-09-16_e8a42541eb4414e42ca955926451ef67_amadey_cobalt-strike_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_njrat_smoke-loader

IMPHASH 02b757059bb7e2d9d372a2e8529f9fff
SHA256 75d24940ab6811e93e16dbe538c398629275d4a9195b9dcf0b2ef525aeb34177
MD5 e8a42541eb4414e42ca955926451ef67
SHA1 c52a974565d618e594af23ec60fe9c56f50da3dc
SHA512 f3018e3318cbb84db804bbf64f37a2548454df251391236ea3fdee82670be69890b01a854e1b3fbf7c6177289b285f7d546a1a802793a814e590d006adfc3ff4
SSDEEP 24576:D6o49O7R28ZRHurMNwGJ5GvIqVSt9SzsrEH7p+:eZoLw2GvIq4tAp+
TLSH
T1D615AE61B841D173E1D10072B6BD5FB28C6C683C0B2558E3E7D40A799AB81E37A79B1F
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

9c:69:60:10:15:21:e5:71:e6:52:e6:8b:33:d8:69:d3:ab:40:5d:4a:c4:96:a4:7b:d3:0a:14:9c:88:cb:89:58

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=220-87-88066,CN=MediaClick Inc.,O=MediaClick Inc.,L=Gangnam-gu,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Chains

Feb 17, 2025

SERIALNUMBER=220-87-88066,CN=MediaClick Inc.,O=MediaClick Inc.,L=Gangnam-gu,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b52

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

SERIALNUMBER=220-87-88066,CN=MediaClick Inc.,O=MediaClick Inc.,L=Gangnam-gu,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b52

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Serial Number

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2021 - Nov 7, 2030

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Serial Number

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 7, 2021 - Dec 29, 2040

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

SERIALNUMBER=220-87-88066,CN=MediaClick Inc.,O=MediaClick Inc.,L=Gangnam-gu,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Serial Number

04:cd:10:be:69:48:a8:4a:70:b1:be:1e:11:c5:33:bc

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2024 - Apr 18, 2025

Minor OS version

Major OS version

Entry point

450986

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

I:\vsprj\favoriteurls_2.5\bin\x86\favoriteurl.pdb

kernel32

CreateEventA WideCharToMultiByte GetProcessHeap DeleteCriticalSection GetProcAddress DecodePointer IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection EncodePointer LCMapStringEx GetStringTypeW GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepEx QueryPerformanceFrequency GetSystemDirectoryW FreeLibrary GetModuleHandleW LoadLibraryW QueryPerformanceCounter GetTickCount Sleep SetLastError FormatMessageW MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects GetCurrentProcessId VerSetConditionMask VerifyVersionInfoW CreateFileW GetFileSizeEx InitializeCriticalSectionAndSpinCount SetEvent HeapAlloc CreateEventW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetFileAttributesExW GetDriveTypeW GetFileInformationByHandle SystemTimeToTzSpecificLocalTime FileTimeToSystemTime CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW SetFilePointerEx ExitProcess GetModuleFileNameW WriteFile GetConsoleMode ReadConsoleW GetConsoleOutputCP FlushFileBuffers GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation SetStdHandle SetEndOfFile GetCurrentDirectoryW GetFullPathNameW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW DeleteFileW WriteConsoleW RaiseException CloseHandle HeapReAlloc GetLastError MultiByteToWideChar HeapSize GetLocaleInfoA GetModuleHandleA WaitForSingleObject CreateMutexA InitializeCriticalSectionEx ResetEvent HeapFree

user32

MessageBoxA

advapi32

RegCloseKey RegQueryValueExA RegCreateKeyExA CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW RegSetValueExA RegOpenKeyExA

shell32

SHGetSpecialFolderPathA

shlwapi

PathIsDirectoryA PathFileExistsA

bcrypt

BCryptGenRandom

ws2_32

gethostname WSAEventSelect sendto recvfrom freeaddrinfo getaddrinfo listen htonl accept select __WSAFDIsSet WSACleanup WSAStartup WSAIoctl WSASetLastError socket setsockopt ntohs htons getsockopt ioctlsocket WSACreateEvent WSACloseEvent send WSAResetEvent getsockname getpeername connect bind recv WSAGetLastError closesocket WSAWaitForMultipleEvents WSAEnumNetworkEvents

wldap32

ord301 ord147 ord133 ord79 ord142 ord167 ord127 ord27 ord26 ord117 ord41 ord208 ord73 ord216 ord14 ord46 ord219 ord145

crypt32

CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CertFindCertificateInStore CryptQueryObject CertEnumCertificatesInStore CertCloseStore CertFreeCertificateContext CertOpenStore CertGetNameStringW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_e8a42541eb4414e42ca955926451ef67_amadey_cobalt-strike_elex_floxif_glassworm_hijackloader_luca-stealer_lynx_njrat_smoke-loader

PE Signature issue

kernel32

user32

advapi32

shell32

shlwapi

bcrypt

ws2_32

wldap32

crypt32

generic