2026-09-24_765bf7b318088de6575143cdceea80f2_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader_virut

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-24_765bf7b318088de6575143cdceea80f2_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader_virut
Size 532KB
Sample260925-hszxnavwct
SHA256 43173fcebd2c53ed79681cf960cb2406c0f603666b35ecd0b2d637449eee5ae7
MD5 765bf7b318088de6575143cdceea80f2
SHA1 59571c331987e0a25f634628b82ec1f48a0df683
SHA512 63bb2523a12ae9607f2648281a98098ea16c2c8cd80eab85011b85596994a4a10ea23c10c2c02298ba43d28c5fbe11657659e5b74de9923dc0eb6c28304e1801
SSDEEP 6144:eL00SuQkhWpYlGkXNuDjBhWvSPtSk3sAOkgXBZeEUWBdS9nqKzGYtWDb0l3eJ:ciuQkhW2rXkqSckc3XBZeEUWOxGYtW
TLSH
T12FC45B41B5C4A432E4B3197286B48A39C83FFE601B5594CB63C8796E9B35DC2B936733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-24_765bf7b318088de6575143cdceea80f2_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader_virut

File Explorer

2026-09-24_765bf7b318088de6575143cdceea80f2_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader_virut

.exe 532KB

2026-09-24_765bf7b318088de6575143cdceea80f2_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader_virut

IMPHASH 09714c297e25bfb5ea8789c219083387
SHA256 43173fcebd2c53ed79681cf960cb2406c0f603666b35ecd0b2d637449eee5ae7
MD5 765bf7b318088de6575143cdceea80f2
SHA1 59571c331987e0a25f634628b82ec1f48a0df683
SHA512 63bb2523a12ae9607f2648281a98098ea16c2c8cd80eab85011b85596994a4a10ea23c10c2c02298ba43d28c5fbe11657659e5b74de9923dc0eb6c28304e1801
SSDEEP 6144:eL00SuQkhWpYlGkXNuDjBhWvSPtSk3sAOkgXBZeEUWBdS9nqKzGYtWDb0l3eJ:ciuQkhW2rXkqSckc3XBZeEUWOxGYtW
TLSH
T12FC45B41B5C4A432E4B3197286B48A39C83FFE601B5594CB63C8796E9B35DC2B936733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

c9:8b:d7:ad:54:25:6b:5c:4e:9a:30:6d:25:02:37:a5:d2:f4:cf:ec:16:78:4e:71:3b:2b:3e:b1:62:76:ee:ed

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Chains

Jun 17, 2026

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Serial Number

01:ba:be:96:e5:0e:a2:5f:3f:0e:88:42:9a:74:a4:62

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 17, 2024 - Jun 19, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

549029

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\landun\workspace\p-ad0484fbdfe349d18f6d70b4084a70ba\src\product\win32\dbginfo\dndcheck.pdb

rpcrt4

UuidCreate

kernel32

HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection GetCommandLineW DeleteFileW GetTempPathW OutputDebugStringW CloseHandle SetEvent WaitForSingleObject CreateEventW OpenEventW GetCurrentProcessId GetLastError LoadResource LockResource SizeofResource FindResourceW FindClose FindFirstFileW FindNextFileW GetFileAttributesW FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryW GetExitCodeProcess MultiByteToWideChar WideCharToMultiByte GetModuleFileNameW ReadConsoleW SetStdHandle SetEnvironmentVariableW RaiseException DecodePointer CreateFileW SetEndOfFile HeapDestroy FindResourceExW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP WriteConsoleW GetACP IsValidCodePage IsDebuggerPresent EnterCriticalSection LeaveCriticalSection GetStringTypeW EncodePointer LCMapStringEx GetCPInfo InitializeCriticalSectionAndSpinCount ResetEvent WaitForSingleObjectEx IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetFileType GetFileSizeEx SetFilePointerEx GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile FindFirstFileExW

advapi32

RegCreateKeyExW RegOpenKeyW RegQueryValueExW RegOpenKeyExW RegCloseKey

shell32

ShellExecuteExW ord680

shlwapi

PathCombineW PathFileExistsW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-24_765bf7b318088de6575143cdceea80f2_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader_virut

PE Signature issue

rpcrt4

kernel32

advapi32

shell32

shlwapi

generic