2026-10-13_f0f638fc7ca8ee3ed631b3310cb819d5_amadey_cobalt-strike_elex_luca-stealer_njrat_play

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-13_f0f638fc7ca8ee3ed631b3310cb819d5_amadey_cobalt-strike_elex_luca-stealer_njrat_play
Size 534KB
Sample261014-b2763aes4v
SHA256 ceeae701d903321ed84b40c5995689f059ab7d12b7ffa9accc47e0c93a1f043a
MD5 f0f638fc7ca8ee3ed631b3310cb819d5
SHA1 8da753d56e8ecd70ec5d8e673ab706390af622c2
SHA512 6bfc4da168690ec72193ac856a03487c7336a41cceaac13005314c259ac5d35abc5ac9ae60b4c7c3995c2be1cebc24188ceed87bf75b8319505295b652035eea
SSDEEP 12288:YXCBopk/+9I4TA2DThEWuQX5biyb+qffSZ2vDOC:YX/C+9LM2D9E0J93fmwDOC
TLSH
T1CBC4F111BDE3C073C677097459F5AB359E7DBCA04FB1ADDB23840BE999209C24B24B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-10-13_f0f638fc7ca8ee3ed631b3310cb819d5_amadey_cobalt-strike_elex_luca-stealer_njrat_play

File Explorer

2026-10-13_f0f638fc7ca8ee3ed631b3310cb819d5_amadey_cobalt-strike_elex_luca-stealer_njrat_play

.exe 534KB

2026-10-13_f0f638fc7ca8ee3ed631b3310cb819d5_amadey_cobalt-strike_elex_luca-stealer_njrat_play

IMPHASH ace14783fb1563836c2fe124c8a4a6e8
SHA256 ceeae701d903321ed84b40c5995689f059ab7d12b7ffa9accc47e0c93a1f043a
MD5 f0f638fc7ca8ee3ed631b3310cb819d5
SHA1 8da753d56e8ecd70ec5d8e673ab706390af622c2
SHA512 6bfc4da168690ec72193ac856a03487c7336a41cceaac13005314c259ac5d35abc5ac9ae60b4c7c3995c2be1cebc24188ceed87bf75b8319505295b652035eea
SSDEEP 12288:YXCBopk/+9I4TA2DThEWuQX5biyb+qffSZ2vDOC:YX/C+9LM2D9E0J93fmwDOC
TLSH
T1CBC4F111BDE3C073C677097459F5AB359E7DBCA04FB1ADDB23840BE999209C24B24B26
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

cc:2f:53:30:72:ac:a4:78:69:37:5f:ac:ad:e5:3a:e3:99:26:cf:74:9f:e7:c8:fb:4e:89:16:55:ee:a6:53:9a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Cong Ty Co Phan Titan Studio,OU=Cong Ty Co Phan Titan Studio,O=Cong Ty Co Phan Titan Studio,L=VN,ST=VN,C=VN

Chains

Sep 28, 2026

CN=Cong Ty Co Phan Titan Studio,OU=Cong Ty Co Phan Titan Studio,O=Cong Ty Co Phan Titan Studio,L=VN,ST=VN,C=VN

Subject

CN=Cong Ty Co Phan Titan Studio,OU=Cong Ty Co Phan Titan Studio,O=Cong Ty Co Phan Titan Studio,L=VN,ST=VN,C=VN

Serial Number

b3:79:c1:09:ff:6a:28:44:a4:ef:01:07:d4:79:ec:f3

Issuer

CN=Cong Ty Co Phan Titan Studio,OU=Cong Ty Co Phan Titan Studio,O=Cong Ty Co Phan Titan Studio,L=VN,ST=VN,C=VN

Timespan

Sep 24, 2025 - Dec 31, 2045

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Minor OS version

Major OS version

Entry point

48335

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wininet

InternetOpenW InternetReadFile InternetOpenUrlW InternetCloseHandle HttpQueryInfoW InternetSetOptionW

gdiplus

GdipSetStringFormatAlign GdipSetStringFormatFlags GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipCloneStringFormat GdipAlloc GdipDrawString GdipCreateFont GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipDrawImageRectRect GdipDrawImageRectI GdipDrawImageRect GdipFillPath GdipFillEllipse GdipFillRectangle GdipGraphicsClear GdipDrawPath GdipDrawLine GdipTranslateWorldTransform GdipSetInterpolationMode GdipSetTextRenderingHint GdipSetPixelOffsetMode GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHDC GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipImageRotateFlip GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdipDeletePen GdipCreatePen2 GdipCreatePen1 GdipGetPathGradientPointCount GdipSetPathGradientSurroundColorsWithCount GdipSetPathGradientCenterColor GdipCreatePathGradientFromPath GdipSetLinePresetBlend GdipCreateLineBrush GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipAddPathEllipse GdipAddPathArc GdipClosePathFigure GdipDeletePath GdipCreatePath GdiplusShutdown GdiplusStartup GdipFree GdipCreateStringFormat

advapi32

RegSetValueExW RegCreateKeyExW CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash RegCloseKey

shell32

ShellExecuteW ShellExecuteExW

ole32

OleInitialize OleUninitialize OleSetContainedObject CoCreateInstance CreateStreamOnHGlobal

oleaut32

VariantInit SysAllocString SysFreeString

user32

IntersectRect InflateRect ScreenToClient SetCursor MessageBoxW GetWindowRect GetClientRect InvalidateRect EndPaint BeginPaint SetForegroundWindow UpdateWindow GetSystemMetrics KillTimer PtInRect ReleaseCapture SetCapture CharLowerBuffW ShowWindow DestroyWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW PostMessageW SendMessageW DispatchMessageW TranslateMessage GetMessageW TrackMouseEvent FindWindowW LoadCursorW LookupIconIdFromDirectoryEx LoadImageW SystemParametersInfoW GetAncestor SetTimer

gdi32

CreateSolidBrush CreateCompatibleBitmap DeleteObject BitBlt SelectObject DeleteDC CreateCompatibleDC

kernel32

VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetFileType HeapAlloc HeapFree GetStdHandle GetModuleHandleExW LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer SetLastError RtlUnwind RaiseException InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetProcessHeap SetStdHandle GetStringTypeW HeapSize GetCurrentProcess GetModuleHandleW GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent Process32NextW Process32FirstW CreateToolhelp32Snapshot WideCharToMultiByte MultiByteToWideChar MoveFileExW QueryFullProcessImageNameW GlobalFree GlobalLock GlobalUnlock GlobalAlloc LoadLibraryW FindResourceW SizeofResource LockResource LoadResource GetProcAddress GetModuleFileNameW OpenProcess CreateProcessW CreateThread TerminateProcess ExitProcess Sleep CreateMutexW WaitForSingleObject ReleaseMutex GetLastError CloseHandle WriteFile SetFilePointerEx SetFileAttributesW RemoveDirectoryW ReadFile GetFileSizeEx GetFileAttributesExW GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CreateFileW CreateDirectoryW SetCurrentDirectoryW WriteConsoleW HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode DecodePointer LCMapStringW GetCommandLineW

Name

.text

Size

127KB

Virtual Size

126KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

334KB

Virtual Size

334KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-13_f0f638fc7ca8ee3ed631b3310cb819d5_amadey_cobalt-strike_elex_luca-stealer_njrat_play

PE Signature issue

wininet

gdiplus

advapi32

shell32

ole32

oleaut32

user32

gdi32

kernel32

generic