2026-09-22_f0dc3d32d9d0c6f27ae57fe984ca62e4_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-22_f0dc3d32d9d0c6f27ae57fe984ca62e4_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat
Size 639KB
Sample260922-3f2wpsyw7n
SHA256 94003145a0f70341543d1ac18dfa141808676c638bb12a23a7050ddba21027e0
MD5 f0dc3d32d9d0c6f27ae57fe984ca62e4
SHA1 60d5d5ace434e40e53d96c8b6eab3fcc95e33e81
SHA512 fc7d402c1a3be99c80a2242e5559449f88694ca755b0ea1d69d2903bc73b2c654d98eb4603a322186ad488365222b64e0ac60ba68258adab196cd638d413248b
SSDEEP 12288:7/anePpLJdCyS49WUbVifzh2HX0Blgtj4EUi4gY6BjvrEH7si:7/anz49WUbVit2HX+S9d4gYMrEH7l
TLSH
T14AD49C117951C1B2D17091F1312DAF6294EDAD385B7618CBB7C01F3A5AA46E32B32E3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-22_f0dc3d32d9d0c6f27ae57fe984ca62e4_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

File Explorer

2026-09-22_f0dc3d32d9d0c6f27ae57fe984ca62e4_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

.exe 639KB

2026-09-22_f0dc3d32d9d0c6f27ae57fe984ca62e4_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

IMPHASH 426d003f3ab6dde15bde82d900763138
SHA256 94003145a0f70341543d1ac18dfa141808676c638bb12a23a7050ddba21027e0
MD5 f0dc3d32d9d0c6f27ae57fe984ca62e4
SHA1 60d5d5ace434e40e53d96c8b6eab3fcc95e33e81
SHA512 fc7d402c1a3be99c80a2242e5559449f88694ca755b0ea1d69d2903bc73b2c654d98eb4603a322186ad488365222b64e0ac60ba68258adab196cd638d413248b
SSDEEP 12288:7/anePpLJdCyS49WUbVifzh2HX0Blgtj4EUi4gY6BjvrEH7si:7/anz49WUbVit2HX+S9d4gYMrEH7l
TLSH
T14AD49C117951C1B2D17091F1312DAF6294EDAD385B7618CBB7C01F3A5AA46E32B32E3B
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

c5:3d:db:60:f4:0f:b4:e0:ec:8e:4e:72:ec:f2:02:c2:d5:00:5d:1f:43:64:b3:a5:eb:95:d0:99:49:46:5a:b0

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=110111-2002444,CN=Teruten Inc.,O=Teruten Inc.,L=Guro-gu,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130553656f756c,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Chains

Jan 19, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

06:df:da:62:2f:03:03:1d:7b:3f:b1:40:c8:f1:97:3e

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 29, 2024 - May 29, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

284864

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ProgramData\Jenkins\.jenkins\workspace\MASTER_WEBCUBE_AGENT_V2\BIN\Release\websp.pdb

kernel32

WaitNamedPipeA HeapFree CallNamedPipeA HeapAlloc GetProcessHeap FlushFileBuffers OpenEventA Process32First FindFirstFileA WritePrivateProfileStringW WriteFile WaitForMultipleObjects FindNextFileA FindClose LocalAlloc GetModuleHandleA OpenProcess CreateToolhelp32Snapshot GetExitCodeThread Sleep GetTempPathA K32GetModuleFileNameExA GetFileAttributesA DeleteFileA Process32Next WritePrivateProfileStringA SetFileAttributesA GetFileSize RemoveDirectoryA CreateProcessA GetExitCodeProcess GetLastError DeleteCriticalSection WriteConsoleW HeapSize CreateFileW SetFilePointerEx GetConsoleMode GetConsoleOutputCP SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW CancelIo GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW IsWow64Process GetSystemInfo GetCurrentProcess SetLastError CreateFileA InitializeCriticalSection LeaveCriticalSection EnterCriticalSection LocalFree CloseHandle HeapReAlloc GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetStdHandle GetModuleFileNameW SetConsoleCtrlHandler GetModuleHandleExW ExitProcess LoadLibraryExW GetModuleFileNameA InitializeCriticalSectionAndSpinCount RaiseException AcquireSRWLockShared ReleaseSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock ConnectNamedPipe CreateEventA GetCurrentProcessId TerminateThread SetEvent ProcessIdToSessionId DisconnectNamedPipe CreateNamedPipeA RtlUnwind InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetModuleHandleW GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess ReadFile GetCommandLineW CreateThread ReleaseMutex WaitForSingleObject CreateMutexA WideCharToMultiByte MultiByteToWideChar CreateDirectoryA FreeLibrary GetProcAddress LoadLibraryA GetSystemWindowsDirectoryA UnhandledExceptionFilter GetStringTypeW GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx SetUnhandledExceptionFilter TlsSetValue ReleaseSemaphore GetCurrentThreadId GetLocaleInfoA TlsAlloc GetLocalTime TlsGetValue TlsFree CreateSemaphoreA WriteProcessMemory VirtualAllocEx CreateRemoteThread VirtualFreeEx RtlCaptureContext

user32

KillTimer GetClientRect SystemParametersInfoA TranslateMessage CreateWindowExA DefWindowProcA GetWindowLongA SetWindowLongA DrawTextA PostQuitMessage ShowWindow GetSystemMetrics SetWindowPos DestroyWindow LoadCursorA DispatchMessageA GetMessageA MessageBoxA RegisterClassExA UpdateWindow wsprintfA EndPaint BeginPaint SetTimer

gdi32

SelectObject CreateFontA DeleteObject

advapi32

AdjustTokenPrivileges GetSidSubAuthority OpenProcessToken GetTokenInformation InitializeSecurityDescriptor SetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorA SetSecurityDescriptorDacl GetSecurityDescriptorSacl RegCreateKeyExA RegQueryValueExA RegSetValueA RegCloseKey RegOpenKeyA LookupPrivilegeValueA

shell32

SHCreateDirectoryExA ShellExecuteA SHGetSpecialFolderPathA

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

rpcrt4

UuidToStringA UuidCreate RpcStringFreeA

wininet

HttpQueryInfoA InternetQueryOptionA HttpOpenRequestA InternetSetOptionA InternetOpenA InternetCloseHandle InternetConnectA InternetReadFile InternetCrackUrlA HttpSendRequestA

httpapi

HttpAddUrl HttpCreateRequestQueue HttpTerminate HttpRemoveUrl HttpSetServiceConfiguration HttpQueryServiceConfiguration HttpReceiveRequestEntityBody HttpShutdownRequestQueue HttpInitialize HttpDeleteServiceConfiguration HttpReceiveHttpRequest HttpSendHttpResponse

ws2_32

WSACleanup inet_addr inet_ntoa gethostname inet_pton gethostbyname WSAStartup htons

iphlpapi

SendARP GetAdaptersInfo

crypt32

CertFreeCertificateContext CertAddCertificateContextToStore CertEnumCertificatesInStore CertCloseStore PFXImportCertStore CertFindCertificateInStore CertGetNameStringA CertOpenStore CertGetCertificateContextProperty PFXIsPFXBlob

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

wintrust

WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData WTHelperGetProvCertFromChain WinVerifyTrust

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-22_f0dc3d32d9d0c6f27ae57fe984ca62e4_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

version

rpcrt4

wininet

httpapi

ws2_32

iphlpapi

crypt32

wtsapi32

wintrust

generic