Extracted

• • Target
    2026-10-09_e71e81ed09742ba55bbff0ff80df7317_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader
  • Size 170KB
  • SHA256 c2e3c86b126ac39e7fccbe2c3e2fd5e9f293dbb88470dfc3c559797e8c29fd08
  • MD5 e71e81ed09742ba55bbff0ff80df7317
  • SHA1 2c27337d6781a3ac249911e19230dd682a20c3e1
  • SHA512 2418ac4788ab945907c5576ca45fcb7bc2baa5438454183499dfcf5bc6cd7fcabd44ccb1fcf5f6ea038390e57c6d7ee8a73257f8b19f51d9d07bf186168dcf52
  • SSDEEP 3072:ud5e+Avc8xT4SBS47rWV2BaL6OuaiN9SCX3yTAQG2E0OldiMwaUjHkEWvX6Df5lt:ud5e+Avc8xT4SBS47rWV2BaL6OuaiN9c
  • TLSH
    T1A6048C2171A2C472D476093084A89EA57A7D7C300FA49EFB23E56A3A4E343D09577FB7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiondonutloaderloaderpersistencespywaretrojaninstallerstealer

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Downloads MZ/PE file

  • Creates new service(s)

    persistenceexecution

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2