2026-10-11_982e1365e946b951afcf609e3f20d32f_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-11_982e1365e946b951afcf609e3f20d32f_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat
Size 602KB
Sample261012-ssab4sf14l
SHA256 42704b96286b1dbfeec576a5acd468bdcd902f76406e391c1ab40bbef556b468
MD5 982e1365e946b951afcf609e3f20d32f
SHA1 7e28f4f0dd1e714b23dc18d7d01862ee432532aa
SHA512 f9456be86b899ac7c70575a9cdbe45f95b713cfa7e6b0b718e150ec90fcd715d871b5538f10728138e13939b7cf46555c0e70fea999c4918f4954234fa8f78f4
SSDEEP 12288:0gpc2uADA1MnNtiOU0CBj26j28gjP4rB75BjvrEH77A:0cCBjpu8nrEH7c
TLSH
T12DD48E50F4808375DDE620B956ECBB25049DF4B8072596C772880BFECA287D16E366FB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-11_982e1365e946b951afcf609e3f20d32f_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

File Explorer

2026-10-11_982e1365e946b951afcf609e3f20d32f_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

.exe 602KB

2026-10-11_982e1365e946b951afcf609e3f20d32f_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

IMPHASH 2b2a73a8f023de4b0d5ba2db7b0914f0
SHA256 42704b96286b1dbfeec576a5acd468bdcd902f76406e391c1ab40bbef556b468
MD5 982e1365e946b951afcf609e3f20d32f
SHA1 7e28f4f0dd1e714b23dc18d7d01862ee432532aa
SHA512 f9456be86b899ac7c70575a9cdbe45f95b713cfa7e6b0b718e150ec90fcd715d871b5538f10728138e13939b7cf46555c0e70fea999c4918f4954234fa8f78f4
SSDEEP 12288:0gpc2uADA1MnNtiOU0CBj26j28gjP4rB75BjvrEH77A:0cCBjpu8nrEH7c
TLSH
T12DD48E50F4808375DDE620B956ECBB25049DF4B8072596C772880BFECA287D16E366FB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

5a:4c:77:40:3e:ae:7f:ad:38:73:26:65:91:47:94:f7:18:7e:be:da:5c:90:3a:ea:58:f2:34:27:6f:b0:fd:af

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 25, 2021

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

5a:4c:77:40:3e:ae:7f:ad:38:73:26:65:91:47:94:f7:18:7e:be:da:5c:90:3a:ea:58:f2:34:27:6f:b0:fd:af

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Intel Corporation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Chains

Jul 22, 2021

CN=Intel Corporation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=Intel Corporation,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Serial Number

0a:de:81:14:d7:67:9b:06:6f:2d:b2:df:d2:f6:7a:c2

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 5, 2021 - Apr 5, 2023

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

Nov 2, 2018 - Dec 31, 2030

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 22, 2015 - Jul 22, 2025

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 23, 2020 - Jan 22, 2032

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b5:21:3f:ca:1e:4a:a0:3d:e4:00:00:00:00:00:b5

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 15, 2020 - Dec 2, 2021

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0b:aa:c1:00:00:00:00:00:09

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:49BC-E37A-233C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:49:80:08:4a:bb:09:a0:33:0b:00:00:00:00:01:49

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Nov 12, 2020 - Feb 11, 2022

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Minor OS version

Major OS version

Entry point

39808

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\buildagent-cd_8811\p4\993441124\services\AMTSW\MEWMIProv\WMIRegistrationService\Release\WMIRegistrationService.pdb

kernel32

QueueUserWorkItem GetModuleFileNameW GetExitCodeProcess RegisterWaitForSingleObject UnregisterWait CreateFileW CreateEventW WaitForSingleObject SetEvent GetLastError CloseHandle SetDefaultDllDirectories OutputDebugStringW DecodePointer ReadConsoleW ReadFile GetConsoleMode GetConsoleCP FlushFileBuffers HeapReAlloc HeapSize SetFilePointerEx UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind RaiseException InterlockedPushEntrySList InterlockedFlushSList SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetCurrentThread HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetProcessHeap SetConsoleCtrlHandler GetFileSizeEx WriteConsoleW

advapi32

SetServiceStatus RegisterServiceCtrlHandlerExW ReportEventW RegisterEventSourceW DeregisterEventSource StartServiceCtrlDispatcherW

shell32

ShellExecuteExW SHGetKnownFolderPath

ole32

CoTaskMemFree

shlwapi

PathFileExistsW

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec

Name

.text

Size

423KB

Virtual Size

422KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

59KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

260B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-11_982e1365e946b951afcf609e3f20d32f_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

PE Signature issue

PE Signature issue

kernel32

advapi32

shell32

ole32

shlwapi

api-ms-win-core-path-l1-1-0

generic