2026-09-16_9fe5e170168f06d86de45957c0840412_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-16_9fe5e170168f06d86de45957c0840412_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat
Size 963KB
Sample260916-xdv3gscf63
SHA256 d59863c40a0ce7e55705f9aec6da4037ba6e345a4d6ed33af0a71370d5b5931b
MD5 9fe5e170168f06d86de45957c0840412
SHA1 f102e9ebe93a45f423aff03e693ae35b89befa84
SHA512 ae1d0cd49aec8b331cf6144af9ac3b22bcd151a7893e546b344437768e9f1f5de935f3adc5f4751a89f8eac66d29ac5daf49bb98e1bb848bce7a2e19594801d8
SSDEEP 24576:2yKxDOuNHY3ig4S2O7hwHEDNQanTHV91o+Qs2kLAF/g25rEH7W:2XN4yg4S7VdDucTaYAFZ
TLSH
T1072501C1BF8277F2C12100323694677E95FF7D390E424ACB63E3BE99AD384829625756
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-16_9fe5e170168f06d86de45957c0840412_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

File Explorer

2026-09-16_9fe5e170168f06d86de45957c0840412_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

.exe 963KB

2026-09-16_9fe5e170168f06d86de45957c0840412_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

IMPHASH 366665a8afe76046e7aff35b7aaab5de
SHA256 d59863c40a0ce7e55705f9aec6da4037ba6e345a4d6ed33af0a71370d5b5931b
MD5 9fe5e170168f06d86de45957c0840412
SHA1 f102e9ebe93a45f423aff03e693ae35b89befa84
SHA512 ae1d0cd49aec8b331cf6144af9ac3b22bcd151a7893e546b344437768e9f1f5de935f3adc5f4751a89f8eac66d29ac5daf49bb98e1bb848bce7a2e19594801d8
SSDEEP 24576:2yKxDOuNHY3ig4S2O7hwHEDNQanTHV91o+Qs2kLAF/g25rEH7W:2XN4yg4S7VdDucTaYAFZ
TLSH
T1072501C1BF8277F2C12100323694677E95FF7D390E424ACB63E3BE99AD384829625756
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

139979

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\devel\ark7\bin.win32\bdzsfx.x86.pdb

kernel32

lstrcmpW MulDiv SetFilePointerEx GetFileSizeEx SetFileAttributesW DeleteFileW SetFileTime SetEndOfFile WriteFile lstrcpyW GetVersion SetFileInformationByHandle DeviceIoControl SetLastError lstrlenW GetFullPathNameW lstrcatW WaitForSingleObject InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection CreateEventW SetEvent ResetEvent CreateDirectoryW GetCurrentDirectoryW SetCurrentDirectoryW CreateHardLinkW RemoveDirectoryW CreateSymbolicLinkW VirtualAlloc VirtualFree GetModuleFileNameW GetFileAttributesW GetCurrentThread FileTimeToSystemTime GetTimeZoneInformation SystemTimeToTzSpecificLocalTime Sleep IsNormalizedString NormalizeString GlobalMemoryStatusEx CompareStringW CreateFileA GetDriveTypeW FlushFileBuffers GetTickCount FindClose GlobalFree GetSystemDirectoryW LoadLibraryW LocalFree MultiByteToWideChar lstrcmpiW InitializeCriticalSectionEx RaiseException GetCurrentThreadId GetUserDefaultLangID DecodePointer GetConsoleOutputCP GetStringTypeW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW SetStdHandle GetConsoleMode LCMapStringW GetStdHandle GetCommandLineW GetCommandLineA ExitProcess GetFileType FreeLibraryAndExitThread ExitThread CreateThread TlsFree WriteConsoleW TlsSetValue TlsGetValue TlsAlloc RtlUnwind GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx InitializeCriticalSectionAndSpinCount LoadLibraryExA IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead WideCharToMultiByte ReadFile CreateFileW FindResourceExW LoadResource FindResourceW LockResource SizeofResource GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy GetLastError FreeLibrary lstrcpynW GetModuleHandleExW CloseHandle GetCurrentProcess GetModuleHandleW LoadLibraryExW GetProcAddress EncodePointer OutputDebugStringW IsDebuggerPresent

user32

SendMessageW RegisterWindowMessageW GetDC SetFocus EndDialog KillTimer EnableWindow SetTimer SetDlgItemTextW PostMessageW MessageBoxW GetWindow MonitorFromWindow GetMonitorInfoW GetClientRect LoadIconW GetWindowTextW DialogBoxParamW UnregisterClassW GetActiveWindow CharNextW DispatchMessageW TranslateMessage PostQuitMessage PeekMessageW InvalidateRect ScreenToClient GetDlgItem CreateWindowExW DestroyWindow MoveWindow EnumChildWindows SetWindowLongW GetWindowLongW FindWindowExW GetClassNameW MapWindowPoints SetWindowTextW GetDlgCtrlID GetParent SetWindowPos SystemParametersInfoW MonitorFromPoint SetProcessDPIAware GetWindowRect ReleaseDC GetWindowTextLengthW

gdi32

CreateFontW DeleteObject GetStockObject GetDeviceCaps GetObjectW

advapi32

RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW AreAllAccessesGranted AccessCheck OpenThreadToken RevertToSelf ImpersonateSelf GetFileSecurityW GetTokenInformation OpenProcessToken

shell32

CommandLineToArgvW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW

ole32

CoInitialize CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoCreateInstance CoUninitialize

oleaut32

VarUI4FromStr

shlwapi

PathCanonicalizeW PathIsDirectoryW

Name

.text

Size

233KB

Virtual Size

233KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

ve_share

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_9fe5e170168f06d86de45957c0840412_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

generic