2026-10-01_3a322db9c3ff3144265694339d603fb6_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_3a322db9c3ff3144265694339d603fb6_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat
Size 264KB
Sample261003-zzxvbafe76
SHA256 06aec57438ce3676a8bb730a06369cc9fa29b7dca2af8826ec0e017f2e464d54
MD5 3a322db9c3ff3144265694339d603fb6
SHA1 17b89f791b73e3ab726c3b0ff4604fdd1f49de1e
SHA512 220d9a9c234002a780800d46ac95dbf699fc04b4c7c98b4a2439d059f6f16567f203667da664cf43336d812fa80bb8a05a28f920c710cd5c3ff04ae6d37871a4
SSDEEP 6144:gIvmAXdCcu9uixajJhSdBjVelqAOk9E7Wiz:PvmAIN9uiojJkh/B
TLSH
T10944AE027AE1C472E973093109B497A6597EBE700E648E9F53942E7ECE34BC19A34737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-01_3a322db9c3ff3144265694339d603fb6_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

.exe 264KB

2026-10-01_3a322db9c3ff3144265694339d603fb6_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

IMPHASH 0300dc004771ce695d5e3539bf626e6b
SHA256 06aec57438ce3676a8bb730a06369cc9fa29b7dca2af8826ec0e017f2e464d54
MD5 3a322db9c3ff3144265694339d603fb6
SHA1 17b89f791b73e3ab726c3b0ff4604fdd1f49de1e
SHA512 220d9a9c234002a780800d46ac95dbf699fc04b4c7c98b4a2439d059f6f16567f203667da664cf43336d812fa80bb8a05a28f920c710cd5c3ff04ae6d37871a4
SSDEEP 6144:gIvmAXdCcu9uixajJhSdBjVelqAOk9E7Wiz:PvmAIN9uiojJkh/B
TLSH
T10944AE027AE1C472E973093109B497A6597EBE700E648E9F53942E7ECE34BC19A34737
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

ff:c2:e3:81:d6:fe:ad:8a:96:23:3d:ea:48:85:a9:f7:71:41:47:ac:9c:24:2c:97:06:6c:c9:28:3d:98:ca:4b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=1037700085444,CN=CRYPTO-PRO LLC,O=CRYPTO-PRO LLC,STREET=proyezd Izmaylovskiy\, 10 / korpus 2 pomeshch 4/1,L=Moscow,ST=Moscow,C=RU,1.3.6.1.4.1.311.60.2.1.2=#13064d6f73636f77,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 16, 2026

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

55:e6:f0:69:a4:e4:66:8b:89:82:d2:dd

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 7, 2023 - Mar 5, 2027

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

57618

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\branches\csp_5_0r4z\branches\csp_5_0r4z_0\csp\out\win32\release\cadescom_enrollctrl.pdb

mfc42u

ord823 ord825

kernel32

WriteConsoleW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetLastError GetModuleHandleA SetLastError GetModuleHandleW GetProcAddress LoadLibraryExA LoadLibraryW GetModuleFileNameW OutputDebugStringA GetModuleFileNameA WideCharToMultiByte SizeofResource LockResource LoadResource FindResourceW FindResourceExW HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap LoadLibraryA CloseHandle SetEvent WaitForSingleObject GetCommandLineW CreateEventW CreateThread RaiseException DecodePointer GetCurrentThreadId Sleep FreeLibrary lstrcmpiW MultiByteToWideChar LoadLibraryExW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose LCMapStringW GetFileType GetStdHandle ExitProcess TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess GetCurrentProcess LocalAlloc VirtualQuery InterlockedExchange GetModuleHandleExW FormatMessageW GetCurrentThread GetPrivateProfileStringW SetFilePointer CreateFileW GetCurrentProcessId OpenEventA WriteFile GetLocalTime OutputDebugStringW lstrlenW GetFileAttributesW lstrcmpW VirtualAlloc UnmapViewOfFile GetSystemInfo CreateFileMappingA OpenFileMappingA MapViewOfFile GetStringTypeW EncodePointer GetCPInfo IsDebuggerPresent IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead

ole32

CoTaskMemRealloc CoTaskMemFree CoCreateInstance StringFromGUID2 CoInitialize CoUninitialize CoAddRefServerProcess CoReleaseServerProcess CoRegisterClassObject CoRevokeClassObject CoResumeClassObjects CoTaskMemAlloc CoGetClassObject ProgIDFromCLSID

oleaut32

SysAllocString SysFreeString VariantInit CreateErrorInfo SetErrorInfo LoadRegTypeLi VarUI4FromStr SysStringLen RegisterTypeLi LoadTypeLi UnRegisterTypeLi VariantClear

ntdll

RtlUnwind

wininet

InternetCrackUrlW InternetCanonicalizeUrlW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_3a322db9c3ff3144265694339d603fb6_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat

mfc42u

kernel32

ole32

oleaut32

ntdll

wininet

generic