2026-10-11_4e857becf95a1cd992025ed1636290a8_amadey_cobalt-strike_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_medusalocker_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-11_4e857becf95a1cd992025ed1636290a8_amadey_cobalt-strike_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_medusalocker_njrat
Size 989KB
Sample261012-1xtkjsbv3k
SHA256 98b07a73effec5ab3117bb845666280d3f690adc513566aa7a21a0b2e6e822fe
MD5 4e857becf95a1cd992025ed1636290a8
SHA1 7719a9fdcc3f1495ed4cfe53b3a4d1f013a75cf3
SHA512 504890fa790b7e3cf57a3761c13bc5323e9f37a6ccf6d9d78d856d9f15d5b13b3e31066608eb3ea33e22d60d12b4352cb2b086a9790c75f32a29f591899b39d7
SSDEEP 24576:YrggoAMPI9u322jq7pO8zwompCoKJC8uF1gvL5BskTh7Bc4W6rEH78:YrgLTjqlO8ixKJ/cqTw4WS
TLSH
T191259F113382C5BAFF6282332A54E31582FEF9950923861F2794777C6F391B25B3D692
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-11_4e857becf95a1cd992025ed1636290a8_amadey_cobalt-strike_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_medusalocker_njrat

File Explorer

2026-10-11_4e857becf95a1cd992025ed1636290a8_amadey_cobalt-strike_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_medusalocker_njrat

.exe 989KB

2026-10-11_4e857becf95a1cd992025ed1636290a8_amadey_cobalt-strike_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_medusalocker_njrat

IMPHASH b1d04b1ebe040659866be4feed8055ce
SHA256 98b07a73effec5ab3117bb845666280d3f690adc513566aa7a21a0b2e6e822fe
MD5 4e857becf95a1cd992025ed1636290a8
SHA1 7719a9fdcc3f1495ed4cfe53b3a4d1f013a75cf3
SHA512 504890fa790b7e3cf57a3761c13bc5323e9f37a6ccf6d9d78d856d9f15d5b13b3e31066608eb3ea33e22d60d12b4352cb2b086a9790c75f32a29f591899b39d7
SSDEEP 24576:YrggoAMPI9u322jq7pO8zwompCoKJC8uF1gvL5BskTh7Bc4W6rEH78:YrgLTjqlO8ixKJ/cqTw4WS
TLSH
T191259F113382C5BAFF6282332A54E31582FEF9950923861F2794777C6F391B25B3D692
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

17:b6:f1:1c:87:44:d4:62:7d:4f:dd:ae:08:0e:47:85:cd:1f:56:ca:34:93:7d:5f:39:6d:15:58:c3:a3:1d:00

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=91540195754285145H,CN=Wondershare Technology Group Co.\,Ltd,O=Wondershare Technology Group Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c0fe8a5bfe8978fe887aae6b2bbe58cba,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Aug 29, 2022

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

d9:90:37:1d:4f:a6:6a:8c:50:d6:47:a2:27:29:02:d2:2e:e4:76:08

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

Chains

Aug 29, 2022

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 29, 2022 - Mar 14, 2033

Subject

Serial Number

05:99:17:fd:77:18:80:8b:c3:4b:e2:24:e4:15:21:6f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 8, 2022 - Apr 5, 2025

Minor OS version

Major OS version

Entry point

202347

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

iphlpapi

GetAdaptersInfo

kernel32

GetFileAttributesW GetFileAttributesExW RemoveDirectoryW SetFilePointer Sleep MoveFileExW GetEnvironmentVariableW SetEnvironmentVariableW GetSystemInfo GetVersionExW GetComputerNameW EnterCriticalSection LeaveCriticalSection FindClose FindFirstFileW FindNextFileW ResetEvent WaitForMultipleObjects InitializeCriticalSectionAndSpinCount TryEnterCriticalSection DeleteCriticalSection GetModuleFileNameW SetConsoleCtrlHandler FreeLibrary GetProcAddress LoadLibraryW VerSetConditionMask SetLastError CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus DeleteFileW QueueUserAPC TerminateThread TlsAlloc TlsGetValue TlsSetValue TlsFree FormatMessageA VerifyVersionInfoA MultiByteToWideChar FormatMessageW LocalFree WideCharToMultiByte GetSystemDirectoryW GetTempPathW GetLongPathNameW GetCurrentDirectoryW WriteFile ReadFile CreateEventW SetEvent GetStartupInfoW TerminateProcess GetCurrentProcessId DuplicateHandle GetStdHandle GetSystemTimeAsFileTime WTSGetActiveConsoleSessionId OpenProcess GetCurrentThread GetExitCodeProcess GetCurrentProcess WaitForSingleObject GetLastError CloseHandle SetWaitableTimer CreateFileW SetConsoleTextAttribute GetConsoleScreenBufferInfo WriteConsoleW HeapSize GetProcessHeap SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetTimeZoneInformation ReadConsoleW FlushFileBuffers GetConsoleMode GetConsoleCP SetFilePointerEx GetFileSizeEx HeapReAlloc QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx SwitchToThread GetCurrentThreadId GetExitCodeThread GetTickCount GetModuleHandleW EncodePointer DecodePointer CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW VirtualAlloc VirtualProtect VirtualFree ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx RaiseException RtlUnwind ExitThread GetModuleHandleExW ExitProcess GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType IsValidLocale GetUserDefaultLCID EnumSystemLocalesW

ole32

CoImpersonateClient

advapi32

RegOpenKeyExW ReportEventW RegisterEventSourceW RegSetValueExW RegCreateKeyExW RegCloseKey OpenServiceW OpenSCManagerW DeleteService CreateServiceW CloseServiceHandle ChangeServiceConfigW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW SetTokenInformation GetTokenInformation DuplicateTokenEx CreateProcessAsUserA OpenThreadToken OpenProcessToken DeregisterEventSource

ws2_32

WSASocketW WSASend WSAGetLastError WSASetLastError WSACleanup WSAStartup shutdown listen htons ioctlsocket closesocket bind WSARecv setsockopt

mswsock

AcceptEx GetAcceptExSockaddrs

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-11_4e857becf95a1cd992025ed1636290a8_amadey_cobalt-strike_darkgate_elex_floxif_hijackloader_luca-stealer_lynx_medusalocker_njrat

PE Signature issue

PE Signature issue

userenv

iphlpapi

kernel32

ole32

advapi32

ws2_32

mswsock

generic