2026-09-28_f7a984a937596c7e0a57180ed94387a5_akira_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-28_f7a984a937596c7e0a57180ed94387a5_akira_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader
Size 969KB
Sample260928-1ffx5athpd
SHA256 87ce8478eaf7a4358319de5c4dcaac4744c2c404dca04de4b01c78bf99ea6083
MD5 f7a984a937596c7e0a57180ed94387a5
SHA1 dee4f1da88cfd1afbdfdeecde2209b43de8c2de7
SHA512 d7b0190a02405b9188376d11e608aef969a986f3bae30577dda1af1a140f2cb4bafc7df7631099071afdb8527ef5fd641dd36f2e6632432c719d1dddd980ddca
SSDEEP 24576:BMxd9+B1cmE7uMPX1rsLxSMXOM9vQCIUspm74Y6X8:u8a7QCCIUso7eX8
TLSH
T17F257BE175428072DA9103714A7C7F7E657C9DF40B65C9CB6FC43A2DCA330D26A3AA4A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-09-28_f7a984a937596c7e0a57180ed94387a5_akira_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader

.exe 969KB

2026-09-28_f7a984a937596c7e0a57180ed94387a5_akira_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader

IMPHASH 0578002c9fc8279f752de56cfee7a485
SHA256 87ce8478eaf7a4358319de5c4dcaac4744c2c404dca04de4b01c78bf99ea6083
MD5 f7a984a937596c7e0a57180ed94387a5
SHA1 dee4f1da88cfd1afbdfdeecde2209b43de8c2de7
SHA512 d7b0190a02405b9188376d11e608aef969a986f3bae30577dda1af1a140f2cb4bafc7df7631099071afdb8527ef5fd641dd36f2e6632432c719d1dddd980ddca
SSDEEP 24576:BMxd9+B1cmE7uMPX1rsLxSMXOM9vQCIUspm74Y6X8:u8a7QCCIUso7eX8
TLSH
T17F257BE175428072DA9103714A7C7F7E657C9DF40B65C9CB6FC43A2DCA330D26A3AA4A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

fb:e2:23:0d:72:2a:c0:74:e8:d5:a7:1a:73:18:b8:28:c1:12:80:03:eb:d9:42:52:ec:1a:68:eb:4c:8a:be:87

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=3876899,CN=Blizzard Entertainment\, Inc.,O=Blizzard Entertainment\, Inc.,L=Irvine,ST=California,C=US,2.5.4.15=#131450726976617465206f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Sep 24, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0d:1d:f3:14:e9:79:07:11:80:07:30:0a:3e:ad:c4:ec

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 5, 2023 - Oct 6, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

480617

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\workspace\BOP_phoenix_release_2.53.1\phoenix\Release\Battle.net.exe.pdb

wininet

HttpQueryInfoA InternetReadFileExA InternetCloseHandle HttpSendRequestA InternetSetCookieW HttpOpenRequestA InternetCrackUrlA InternetSetOptionA InternetConnectA InternetSetStatusCallbackA InternetOpenA

kernel32

WriteFile TerminateProcess CreateDirectoryW GetFileAttributesW GetModuleFileNameW FindFirstFileW FindClose GetComputerNameW GetModuleHandleA SetEvent CreateEventW LoadLibraryW ReadFile GetFileSizeEx GetFileSize GetCompressedFileSizeW GetFileAttributesExW SetCurrentDirectoryW GetCurrentDirectoryW FindNextFileW FlushFileBuffers GetShortPathNameW GetDiskFreeSpaceExW SetFilePointer MoveFileW RemoveDirectoryW SetEndOfFile GetVolumeInformationW DeviceIoControl GetFileInformationByHandle SetFileTime SetFileAttributesW DeleteFileW SetFilePointerEx SetFileValidData GetSystemInfo SetThreadAffinityMask LocalFree LocalAlloc WideCharToMultiByte InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection OpenProcess MultiByteToWideChar SetThreadPriority GetThreadPriority TlsAlloc TlsSetValue TlsGetValue TlsFree QueryPerformanceCounter GetSystemTimeAsFileTime QueryPerformanceFrequency GetTickCount FileTimeToSystemTime SystemTimeToFileTime GetSystemDefaultLCID GetCommandLineW SetLastError WriteConsoleW GetStartupInfoW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW UnhandledExceptionFilter GetCurrentThread GetModuleHandleW VirtualQuery SetUnhandledExceptionFilter IsDebuggerPresent OutputDebugStringW WaitForSingleObject CreateThread GetCurrentThreadId GetCurrentProcess GetCurrentProcessId CreateFileW Sleep GetLastError GetDiskFreeSpaceW FreeLibrary CloseHandle GetProcAddress GetDriveTypeW GetConsoleOutputCP GetConsoleMode HeapReAlloc ReadConsoleW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringW GetTimeFormatW GetDateFormatW HeapFree HeapAlloc GetStdHandle ExitProcess GetFileType SetStdHandle GetTimeZoneInformation GetCommandLineA IsProcessorFeaturePresent WaitForSingleObjectEx ResetEvent InitializeCriticalSectionAndSpinCount GetFullPathNameW GetModuleHandleExW FreeLibraryAndExitThread SetEnvironmentVariableW GetProcessHeap HeapSize RtlUnwind InterlockedPushEntrySList LoadLibraryExW RaiseException GetStringTypeW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeCriticalSectionEx EncodePointer DecodePointer CompareStringEx GetCPInfo LCMapStringEx InitializeSListHead ExitThread

user32

GetShellWindow GetWindowThreadProcessId MessageBoxW GetForegroundWindow

advapi32

OpenProcessToken ConvertStringSecurityDescriptorToSecurityDescriptorW LookupPrivilegeValueW GetTokenInformation AdjustTokenPrivileges DuplicateTokenEx MapGenericMask AccessCheck CloseServiceHandle QueryServiceConfigW OpenServiceW OpenSCManagerW ConvertSecurityDescriptorToStringSecurityDescriptorW SetEntriesInAclW GetNamedSecurityInfoW SetNamedSecurityInfoW GetFileSecurityW AllocateAndInitializeSid BuildTrusteeWithSidW OpenThreadToken DuplicateToken

shell32

ShellExecuteExW CommandLineToArgvW SHGetFolderPathW

oleaut32

VariantClear

wintrust

WinVerifyTrust

crypt32

CertFindCertificateInStore CryptQueryObject CertFreeCertificateContext CertCloseStore CryptMsgClose CertGetNameStringW CryptMsgGetParam

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-28_f7a984a937596c7e0a57180ed94387a5_akira_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader

wininet

kernel32

user32

advapi32

shell32

oleaut32

wintrust

crypt32

generic