2026-10-05_b29d99d91cad2539e0d9f19422f08378_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-05_b29d99d91cad2539e0d9f19422f08378_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat
Size 659KB
Sample261006-vc31lassfs
SHA256 3bd912d589ff98000bf19f4066a5129c70a081afa14e3a715289d832cd138e02
MD5 b29d99d91cad2539e0d9f19422f08378
SHA1 f529af71ae1c0c167d9dcb315c34ef9db36845d3
SHA512 52949d10cca77a9b30ab2bc337fff84a326ae163e112f1713a903269eafb91d2ec9f03493f637ddafd20d511556e2673cbb8167b1ccc4ed6f9e8f15d4b9c4135
SSDEEP 12288:9d9cyWtfoCKohPerXXqxHr4CttZHZZV4DrskZ9J/tVUiqDFGBjvrEH73n:r9c8XXqxtttZHb2skPx7VyFQrEH7X
TLSH
T188E49D167941C1B9D47111B1322DAF7290ADAD391BB608CBB7C00F7A59642E37F39E3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-05_b29d99d91cad2539e0d9f19422f08378_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

File Explorer

2026-10-05_b29d99d91cad2539e0d9f19422f08378_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

.exe 659KB

2026-10-05_b29d99d91cad2539e0d9f19422f08378_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

IMPHASH 69bd6c87709c74aa8e8d3e1b34fbb179
SHA256 3bd912d589ff98000bf19f4066a5129c70a081afa14e3a715289d832cd138e02
MD5 b29d99d91cad2539e0d9f19422f08378
SHA1 f529af71ae1c0c167d9dcb315c34ef9db36845d3
SHA512 52949d10cca77a9b30ab2bc337fff84a326ae163e112f1713a903269eafb91d2ec9f03493f637ddafd20d511556e2673cbb8167b1ccc4ed6f9e8f15d4b9c4135
SSDEEP 12288:9d9cyWtfoCKohPerXXqxHr4CttZHZZV4DrskZ9J/tVUiqDFGBjvrEH73n:r9c8XXqxtttZHb2skPx7VyFQrEH7X
TLSH
T188E49D167941C1B9D47111B1322DAF7290ADAD391BB608CBB7C00F7A59642E37F39E3A
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

ca:39:d0:36:81:22:37:b0:91:2f:4a:23:29:c6:a1:94:17:bc:71:6e:12:fb:16:78:49:a3:63:67:c1:03:54:16

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=110111-2002444,CN=Teruten Inc.,O=Teruten Inc.,L=Guro District,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130553656f756c,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Chains

Jul 24, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

04:79:15:94:cc:4e:e3:9c:9d:ce:32:5d:5d:79:38:a9

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 29, 2026 - Jun 23, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

300224

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ProgramData\Jenkins\.jenkins\workspace\MASTER_WEBCUBE_AGENT_V2\BIN\Release\websp.pdb

kernel32

GetProcessHeap GetTickCount FlushFileBuffers OpenEventA Process32First FindFirstFileA WritePrivateProfileStringW WriteFile OutputDebugStringA WaitForMultipleObjects FindNextFileA FindClose LocalAlloc GetModuleHandleA OpenProcess CreateToolhelp32Snapshot GetExitCodeThread GetTempPathA K32GetModuleFileNameExA GetFileAttributesA DeleteFileA Process32Next WritePrivateProfileStringA SetFileAttributesA GetLocalTime GetFileSize RemoveDirectoryA CreateProcessA GetExitCodeProcess ProcessIdToSessionId DisconnectNamedPipe CreateNamedPipeA ReadFile WriteConsoleW HeapSize CreateFileW SetFilePointerEx CreateThread GetConsoleOutputCP SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP HeapAlloc IsValidCodePage FindNextFileW FindFirstFileExW CallNamedPipeA SetEvent Sleep HeapFree GetLastError DeleteCriticalSection CreateFileA InitializeCriticalSection LeaveCriticalSection EnterCriticalSection LocalFree CloseHandle HeapReAlloc GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetStdHandle GetModuleFileNameA GetModuleFileNameW SetConsoleCtrlHandler GetModuleHandleExW ExitProcess LoadLibraryExW InitializeCriticalSectionAndSpinCount RaiseException WaitNamedPipeA CancelIo IsWow64Process GetSystemInfo GetCurrentProcess SetLastError AcquireSRWLockShared ReleaseSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock ConnectNamedPipe CreateEventA RtlUnwind InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetModuleHandleW GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcessId TerminateThread GetACP ReleaseMutex WaitForSingleObject CreateMutexA WideCharToMultiByte MultiByteToWideChar CreateDirectoryA FreeLibrary GetProcAddress LoadLibraryA GetSystemWindowsDirectoryA GetConsoleMode UnhandledExceptionFilter GetStringTypeW GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx SetUnhandledExceptionFilter TlsSetValue ReleaseSemaphore GetCurrentThreadId GetLocaleInfoA TlsAlloc TlsGetValue TlsFree CreateSemaphoreA WriteProcessMemory VirtualAllocEx CreateRemoteThread VirtualFreeEx RtlCaptureContext

user32

KillTimer GetClientRect SystemParametersInfoA TranslateMessage CreateWindowExA DefWindowProcA GetWindowLongA SetWindowLongA DrawTextA PostQuitMessage ShowWindow GetSystemMetrics SetWindowPos DestroyWindow LoadCursorA DispatchMessageA GetMessageA MessageBoxA RegisterClassExA UpdateWindow wsprintfA EndPaint BeginPaint SetTimer

gdi32

SelectObject CreateFontA DeleteObject

advapi32

AdjustTokenPrivileges GetSidSubAuthority OpenProcessToken GetTokenInformation InitializeSecurityDescriptor SetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorA SetSecurityDescriptorDacl GetSecurityDescriptorSacl RegCreateKeyExA RegQueryValueExA RegSetValueA AllocateAndInitializeSid FreeSid InitializeAcl GetLengthSid AddAccessAllowedAce RegCloseKey RegOpenKeyA LookupPrivilegeValueA

shell32

SHCreateDirectoryExA ShellExecuteA SHGetSpecialFolderPathA

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

rpcrt4

UuidToStringA UuidCreate RpcStringFreeA

wininet

HttpQueryInfoA HttpOpenRequestA InternetSetOptionA InternetOpenA InternetCloseHandle HttpSendRequestA InternetConnectA InternetReadFile InternetCrackUrlA InternetQueryOptionA

httpapi

HttpAddUrl HttpCreateRequestQueue HttpTerminate HttpRemoveUrl HttpSetServiceConfiguration HttpReceiveRequestEntityBody HttpQueryServiceConfiguration HttpSendHttpResponse HttpShutdownRequestQueue HttpInitialize HttpDeleteServiceConfiguration HttpReceiveHttpRequest

ws2_32

WSACleanup inet_addr inet_ntoa gethostname inet_pton gethostbyname WSAStartup htons

iphlpapi

SendARP GetAdaptersInfo

crypt32

CertFreeCertificateContext CertAddCertificateContextToStore CertEnumCertificatesInStore CertCloseStore PFXImportCertStore CertFindCertificateInStore CertGetNameStringA CertOpenStore CertGetCertificateContextProperty PFXIsPFXBlob

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

wintrust

WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData WTHelperGetProvCertFromChain WinVerifyTrust

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-05_b29d99d91cad2539e0d9f19422f08378_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

version

rpcrt4

wininet

httpapi

ws2_32

iphlpapi

crypt32

wtsapi32

wintrust

generic