2026-09-23_cf9167f628b4d72d14d4a327df2330cb_amadey_cobalt-strike_elex_luca-stealer_njrat_play

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-23_cf9167f628b4d72d14d4a327df2330cb_amadey_cobalt-strike_elex_luca-stealer_njrat_play
Size 143KB
Sample260924-bq2vxaba26
SHA256 252dc22eeac9c0f078fc67d3994d2229e9ea9f21d71dc60ccb15a340c287be69
MD5 cf9167f628b4d72d14d4a327df2330cb
SHA1 fc2d108edc45ccd6638303fca06b1763590939ae
SHA512 9b13e1a6bb77b00ba5fbeb295dda94886e7021b61ed71c2d03719cab4d96797e05dfe11bc6f05afb15da13f726cf1977d6aef8cacecd37cf20976857662c59cc
SSDEEP 3072:au8JX3aBS2qlgnbNcmbk2ETviO2Ze2sJYtEhj7ak99uS9:pBSgnbmmbkdjVV5Oc9
TLSH
T1D7E35A01B6E2C071E5BA2A313974AB75863DF8705F349EEF23C411B95E346C09A36B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-23_cf9167f628b4d72d14d4a327df2330cb_amadey_cobalt-strike_elex_luca-stealer_njrat_play

File Explorer

2026-09-23_cf9167f628b4d72d14d4a327df2330cb_amadey_cobalt-strike_elex_luca-stealer_njrat_play

.exe 143KB

2026-09-23_cf9167f628b4d72d14d4a327df2330cb_amadey_cobalt-strike_elex_luca-stealer_njrat_play

IMPHASH 2c656932b0aa972cbf7cc3e1a00660e3
SHA256 252dc22eeac9c0f078fc67d3994d2229e9ea9f21d71dc60ccb15a340c287be69
MD5 cf9167f628b4d72d14d4a327df2330cb
SHA1 fc2d108edc45ccd6638303fca06b1763590939ae
SHA512 9b13e1a6bb77b00ba5fbeb295dda94886e7021b61ed71c2d03719cab4d96797e05dfe11bc6f05afb15da13f726cf1977d6aef8cacecd37cf20976857662c59cc
SSDEEP 3072:au8JX3aBS2qlgnbNcmbk2ETviO2Ze2sJYtEhj7ak99uS9:pBSgnbmmbkdjVV5Oc9
TLSH
T1D7E35A01B6E2C071E5BA2A313974AB75863DF8705F349EEF23C411B95E346C09A36B67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17471

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

TranslateMessage GetMessageW DispatchMessageW ExitWindowsEx SendMessageW PostMessageW DefWindowProcW PostQuitMessage RegisterClassExW CreateWindowExW DestroyWindow ShowWindow MoveWindow SetCapture ReleaseCapture UpdateWindow BeginPaint EndPaint InvalidateRect SetWindowTextW GetClientRect AdjustWindowRectEx MessageBoxW SetCursor GetCursorPos ScreenToClient PtInRect GetWindowLongW LoadCursorW TrackMouseEvent LoadIconW

gdi32

DeleteObject DeleteDC CreateFontW CreateCompatibleDC CreateCompatibleBitmap BitBlt SelectObject

gdiplus

GdiplusShutdown GdiplusStartup GdipCreatePath GdipDeletePath GdipClosePathFigure GdipDeleteBrush GdipCreateSolidFill GdipCreateLineBrushFromRect GdipCreatePen1 GdipDeletePen GdipSetPenLineCap197819 GdipDisposeImage GdipCreateBitmapFromStream GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetTextRenderingHint GdipDrawLine GdipDrawPath GdipFillRectangleI GdipFillEllipse GdipFillPath GdipDrawImageRect GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipDrawString GdipCreateStringFormat GdipDeleteStringFormat GdipSetStringFormatFlags GdipSetStringFormatAlign GdipSetStringFormatTrimming GdipAddPathArc

comctl32

InitCommonControlsEx ord345

shlwapi

PathRemoveFileSpecW PathCombineW ord12

shell32

ShellExecuteW SHGetFolderPathW

advapi32

AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueW

kernel32

VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW LCMapStringW GetProcessHeap SetFilePointerEx HeapSize HeapReAlloc GetCommandLineA GetCPInfo GetOEMCP GetConsoleMode IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileType HeapAlloc HeapFree GetModuleHandleExW ExitProcess GetStdHandle RaiseException EncodePointer LoadLibraryExW GetProcAddress FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection RtlUnwind GetModuleHandleW GetStartupInfoW FlushFileBuffers GetCommandLineW GetConsoleOutputCP IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent DecodePointer GetACP ReadFile CreateFileW GetFileAttributesW GetFileSizeEx WriteConsoleW WriteFile CloseHandle GetLastError SetLastError GetCurrentProcess GetModuleFileNameW LoadResource LockResource SizeofResource FindResourceW LocalFree FormatMessageW MultiByteToWideChar WideCharToMultiByte UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess

Name

.text

Size

85KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-23_cf9167f628b4d72d14d4a327df2330cb_amadey_cobalt-strike_elex_luca-stealer_njrat_play

user32

gdi32

gdiplus

comctl32

shlwapi

shell32

advapi32

kernel32

generic