2026-10-13_42f07b43ce6a5abe59681d5ea2061b18_amadey_cobalt-strike_elex_luca-stealer_njrat_play

General

Target
2026-10-13_42f07b43ce6a5abe59681d5ea2061b18_amadey_cobalt-strike_elex_luca-stealer_njrat_play
Size 115KB
Sample261015-sdapbshs7q
SHA256 9361221b9900253f57fb57495edffc5a79dd3fb3242f3a03978dc359e99bca27
MD5 42f07b43ce6a5abe59681d5ea2061b18
SHA1 976f8d0e44ddbc739da5301ddeae120a7a67bc05
SHA512 d2fce43773364380fdb0378b3779c99406be9aeebae2f5cd0975aab153d44b97d6496302f25e07134e39f0703209c8fb85bb35bcb70f4b886b4b603d84272eaa
SSDEEP 3072:R3g1L+2mQkbpkRtrKihGvbuPEX3iA42ba/yxJ1aM4y:tg9FmtpcrlhGvtnr/xn4y
TLSH
T1D5C36C01B4C1C472D9B9693509A8DAB54A3EF8300F609EDFB7C816B99F342C09A35E77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-13_42f07b43ce6a5abe59681d5ea2061b18_amadey_cobalt-strike_elex_luca-stealer_njrat_play

File Explorer

2026-10-13_42f07b43ce6a5abe59681d5ea2061b18_amadey_cobalt-strike_elex_luca-stealer_njrat_play

.exe 115KB

2026-10-13_42f07b43ce6a5abe59681d5ea2061b18_amadey_cobalt-strike_elex_luca-stealer_njrat_play

IMPHASH 6c5c94f08c51e22755e4c07022d0f13a
SHA256 9361221b9900253f57fb57495edffc5a79dd3fb3242f3a03978dc359e99bca27
MD5 42f07b43ce6a5abe59681d5ea2061b18
SHA1 976f8d0e44ddbc739da5301ddeae120a7a67bc05
SHA512 d2fce43773364380fdb0378b3779c99406be9aeebae2f5cd0975aab153d44b97d6496302f25e07134e39f0703209c8fb85bb35bcb70f4b886b4b603d84272eaa
SSDEEP 3072:R3g1L+2mQkbpkRtrKihGvbuPEX3iA42ba/yxJ1aM4y:tg9FmtpcrlhGvtnr/xn4y
TLSH
T1D5C36C01B4C1C472D9B9693509A8DAB54A3EF8300F609EDFB7C816B99F342C09A35E77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

8050

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

bcrypt

BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptCreateHash BCryptOpenAlgorithmProvider

shell32

ShellExecuteW

user32

MessageBoxW

kernel32

TlsGetValue DecodePointer GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize SetFilePointerEx CreateFileW GetFileAttributesW ReadFile CloseHandle WaitForSingleObject Sleep CreateRemoteThread GetExitCodeThread OpenProcess VirtualAllocEx WriteProcessMemory VirtualFreeEx GetModuleFileNameW GetModuleHandleW GetProcAddress QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetProcessHeap RaiseException RtlUnwind GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc WriteConsoleW TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-13_42f07b43ce6a5abe59681d5ea2061b18_amadey_cobalt-strike_elex_luca-stealer_njrat_play

bcrypt

shell32

user32

kernel32

generic