2026-09-24_82a0e4acc5878626a76a618f5665e647_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-24_82a0e4acc5878626a76a618f5665e647_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat
Size 885KB
Sample260925-gs5bpsbb63
SHA256 43c48d79291b7f46e0d568fb72eac569bd6630096f383bb512af509f80187db0
MD5 82a0e4acc5878626a76a618f5665e647
SHA1 83a0fb2ead08ccf9722421209551fd2ff4092ba3
SHA512 00b1d31270dee10757caa1a798a423716969560da1f856318bb6c7f7bdf72b4f144ca7b4b6b278dbdbb76f08db8c7a78fffdb40ac49b93afa9a1f9f7f239cfbe
SSDEEP 24576:mUdknFCnlHHSBlIE7q5wlaMBzOoI9XtchzjX0:mQknFCntHSrFGwTSoI9XYjX0
TLSH
T17E157C527484E032D11241702D1CA7B5A2BDBD351F61BACBB7D4FF3928B43D2AA71A27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-09-24_82a0e4acc5878626a76a618f5665e647_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

.exe 885KB

2026-09-24_82a0e4acc5878626a76a618f5665e647_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

IMPHASH e957c0098f72e5de60f20784d94ac371
SHA256 43c48d79291b7f46e0d568fb72eac569bd6630096f383bb512af509f80187db0
MD5 82a0e4acc5878626a76a618f5665e647
SHA1 83a0fb2ead08ccf9722421209551fd2ff4092ba3
SHA512 00b1d31270dee10757caa1a798a423716969560da1f856318bb6c7f7bdf72b4f144ca7b4b6b278dbdbb76f08db8c7a78fffdb40ac49b93afa9a1f9f7f239cfbe
SSDEEP 24576:mUdknFCnlHHSBlIE7q5wlaMBzOoI9XtchzjX0:mQknFCntHSrFGwTSoI9XYjX0
TLSH
T17E157C527484E032D11241702D1CA7B5A2BDBD351F61BACBB7D4FF3928B43D2AA71A27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

97:07:56:b2:36:b0:dc:5c:21:88:3d:a6:1d:36:1d:fb:23:dd:d7:8b:fb:47:95:b8:4a:83:6a:9a:66:03:50:b9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=110111-2002444,CN=Teruten Inc.,O=Teruten Inc.,L=Guro-gu,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130553656f756c,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Chains

Apr 29, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

06:df:da:62:2f:03:03:1d:7b:3f:b1:40:c8:f1:97:3e

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 29, 2024 - May 29, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

474819

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ProgramData\Jenkins\.jenkins\workspace\MASTER_ANTI_CAPTURE\BIN\Release\TDependup.pdb

kernel32

GlobalFree MulDiv FormatMessageA LoadLibraryExW GlobalDeleteAtom CompareStringA GetPrivateProfileIntA GetPrivateProfileStringA WritePrivateProfileStringA GlobalAddAtomA EncodePointer GetSystemDirectoryW lstrcmpW GlobalFindAtomA GlobalGetAtomNameA FileTimeToLocalFileTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime LocalAlloc GlobalReAlloc GlobalHandle LocalReAlloc GetThreadLocale GetLocaleInfoW GetSystemDefaultUILanguage GetUserDefaultUILanguage GlobalFlags FlushFileBuffers GetFullPathNameA LockFile SetEndOfFile UnlockFile GetVolumeInformationA VirtualProtect GetOEMCP GetCPInfo GetFileAttributesExA GetFileSizeEx SetErrorMode GetUserDefaultLCID UnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime GlobalUnlock SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW IsValidCodePage GetConsoleOutputCP GetTimeZoneInformation ReadConsoleW GetConsoleMode EnumSystemLocalesW IsValidLocale LCMapStringW CompareStringW GetStdHandle SetStdHandle HeapQueryInformation GetCommandLineW GetCommandLineA QueryPerformanceFrequency GetFileType GetDriveTypeW SetConsoleCtrlHandler GetModuleHandleExW ExitProcess VirtualQuery RtlUnwind GetStringTypeW SetFilePointerEx GetFullPathNameW FindNextFileW FindFirstFileExW CreateFileW GetCurrentDirectoryW OutputDebugStringW GlobalLock GlobalAlloc lstrcmpA LoadLibraryW GetModuleFileNameW InitializeCriticalSectionAndSpinCount OutputDebugStringA GetACP AcquireSRWLockShared ReleaseSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock GetCurrentThread CopyFileA IsWow64Process MapViewOfFile CreateFileMappingA UnmapViewOfFile FindResourceA EnumResourceNamesA GetFileTime GetUserDefaultLangID SetLastError OpenThread VirtualFreeEx K32EnumProcessModules CreateRemoteThread GetModuleHandleW ReadProcessMemory VirtualAllocEx GetFileAttributesA SuspendThread FindClose Thread32First Thread32Next FindNextFileA FindFirstFileA WriteProcessMemory GetExitCodeProcess ConnectNamedPipe LocalFree ResetEvent Process32Next DeleteFileA QueryFullProcessImageNameA K32GetModuleFileNameExA OpenProcess DisconnectNamedPipe SetFilePointer WaitForMultipleObjects TerminateProcess CreateNamedPipeA Process32First ReadFile CreateMutexA GetComputerNameA GetWindowsDirectoryA FindResourceW LoadResource LockResource DuplicateHandle VirtualAlloc SizeofResource GetSystemInfo GetVersionExA GetSystemDirectoryA CreateToolhelp32Snapshot GetModuleHandleA Module32First Module32Next TerminateThread SetEvent GetExitCodeThread CreateEventA CreateSemaphoreA TlsFree TlsGetValue GetFileSize TlsAlloc GetLocaleInfoA WaitForSingleObject ReleaseSemaphore TlsSetValue SetUnhandledExceptionFilter FreeLibrary GetProcAddress LoadLibraryA GetTempPathA InitializeCriticalSection GetCurrentProcess RtlCaptureContext GetModuleFileNameA WideCharToMultiByte MultiByteToWideChar GetTickCount CreateDirectoryA GetProcessHeap GetCurrentProcessId DeleteCriticalSection DecodePointer GetLocalTime HeapAlloc CreateThread RaiseException CloseHandle HeapReAlloc CreateFileA GetLastError Sleep ProcessIdToSessionId HeapSize ResumeThread GetCurrentThreadId InitializeCriticalSectionEx LeaveCriticalSection SetThreadPriority WriteFile EnterCriticalSection InitializeSListHead HeapFree WriteConsoleW

user32

GetClassLongA PtInRect EqualRect CopyRect GetSysColor MapWindowPoints ScreenToClient AdjustWindowRectEx GetWindowRect RemovePropA GetPropA SetPropA GetScrollPos RedrawWindow EndPaint BeginPaint SetForegroundWindow GetForegroundWindow SetActiveWindow UpdateWindow SetMenu GetMenu GetCapture EndDeferWindowPos DeferWindowPos BeginDeferWindowPos DestroyWindow IsChild IsMenu UnregisterClassA GetTopWindow PeekMessageA TranslateMessage CreateWindowExA GetClassInfoExA GetClassInfoA RegisterClassA CallWindowProcA DefWindowProcA GetMessageTime GetMessagePos RegisterWindowMessageA LoadBitmapW SetMenuItemInfoA GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem MapDialogRect SetWindowContextHelpId IsDialogMessageA GetWindow SetWindowTextA GetSysColorBrush GetFocus SetFocus GetDlgCtrlID PostThreadMessageA GetDlgItem SetWindowPos MoveWindow ShowWindow IsWindow UnhookWindowsHookEx LoadIconA WinHelpA MonitorFromWindow GetMonitorInfoA CreateDialogIndirectParamA EndDialog GetNextDlgTabItem GetDesktopWindow DrawTextA DrawTextExA GrayStringA TabbedTextOutA GetDC GetWindowDC ReleaseDC ClientToScreen wsprintfA MessageBoxA DispatchMessageA GetWindowTextA GetWindowThreadProcessId EnableWindow IsIconic IsClipboardFormatAvailable GetClientRect SetClipboardData SendMessageA LoadIconW GetClipboardData GetWindowLongA EmptyClipboard CloseClipboard SetWindowLongA ChangeClipboardChain OpenClipboard DrawIcon GetClassNameA GetSystemMetrics GetClipboardOwner GetClipboardViewer SetClipboardViewer SetRect IsRectEmpty GetAsyncKeyState SetWinEventHook SendDlgItemMessageA SetRectEmpty OffsetRect GetParent GetSubMenu GetMenuItemID GetMenuItemCount GetMessageA IsWindowVisible GetActiveWindow LoadCursorA RealChildWindowFromPoint SetTimer KillTimer InvalidateRect SetCapture ReleaseCapture CharUpperA CharNextA CopyAcceleratorTableA InvalidateRgn IntersectRect GetNextDlgGroupItem MessageBeep DestroyMenu RegisterClipboardFormatA GetKeyState ValidateRect GetCursorPos SetWindowsHookExA CallNextHookEx PostMessageA PostQuitMessage SetCursor IsWindowEnabled GetLastActivePopup

gdi32

SaveDC ExtSelectClipRgn SetMapMode TextOutA RestoreDC SetViewportExtEx SetViewportOrgEx SetWindowExtEx OffsetViewportOrgEx ScaleViewportExtEx ScaleWindowExtEx GetBkColor GetTextColor CreateRectRgnIndirect GetRgnBox GetMapMode RectVisible PtVisible GetWindowExtEx GetViewportExtEx GetStockObject GetClipBox Escape SetTextColor SetBkColor CreateBitmap GetDeviceCaps SelectObject DeleteDC ExtTextOutA GetObjectA DeleteObject

winspool.drv

DocumentPropertiesA OpenPrinterA ClosePrinter

advapi32

RegEnumValueA RegQueryValueA RegEnumKeyA RegCreateKeyExA SetEntriesInAclA SetNamedSecurityInfoA GetNamedSecurityInfoA ConvertStringSidToSidA GetSecurityDescriptorSacl SetSecurityDescriptorDacl ConvertSidToStringSidA SetSecurityDescriptorSacl LookupAccountSidA InitializeSecurityDescriptor RegOpenKeyExA ConvertStringSecurityDescriptorToSecurityDescriptorW GetTokenInformation RegCreateKeyA AdjustTokenPrivileges RegCloseKey RegOpenKeyA RegDeleteKeyA RegQueryValueExA LookupPrivilegeValueA RegSetValueExA OpenProcessToken RegDeleteValueA

shell32

ShellExecuteA SHGetFolderPathA SHGetSpecialFolderPathA

shlwapi

PathFindExtensionA PathFindFileNameA UrlUnescapeA PathIsUNCA PathStripToRootA

ole32

CreateILockBytesOnHGlobal StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CoGetClassObject CLSIDFromProgID CLSIDFromString CoInitialize CoCreateInstance CoCreateGuid CoUninitialize CoTaskMemAlloc CoTaskMemFree CoRevokeClassObject OleFlushClipboard OleIsCurrentClipboard CoRegisterMessageFilter CoFreeUnusedLibraries OleInitialize OleUninitialize

oleaut32

SysAllocString OleCreateFontIndirect VariantCopy SafeArrayDestroy VariantTimeToSystemTime SystemTimeToVariantTime SysStringLen VariantChangeType VariantClear VariantInit SysAllocStringByteLen SysFreeString SysAllocStringLen

oledlg

ord8

gdiplus

GdiplusShutdown

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

ws2_32

inet_ntoa gethostname gethostbyname WSACleanup WSAStartup

iphlpapi

GetAdaptersInfo

wtsapi32

WTSQueryUserToken

ntdll

NtSuspendProcess NtResumeProcess NtQueryInformationProcess

oleacc

CreateStdAccessibleObject LresultFromObject

wininet

HttpQueryInfoA InternetCrackUrlA InternetCanonicalizeUrlA InternetOpenA InternetCloseHandle InternetConnectA InternetReadFile InternetSetFilePointer InternetWriteFile InternetQueryDataAvailable InternetGetLastResponseInfoA InternetSetStatusCallback HttpSendRequestA HttpOpenRequestA HttpAddRequestHeadersA

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-24_82a0e4acc5878626a76a618f5665e647_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

shlwapi

ole32

oleaut32

oledlg

gdiplus

version

ws2_32

iphlpapi

wtsapi32

ntdll

oleacc

wininet

generic