2026-10-19_a677aeadaa5e74f912340966966a34e7_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-19_a677aeadaa5e74f912340966966a34e7_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader
Size 873KB
Sample261020-m716gsbb74
SHA256 11c94f8edfb979f75c2d2b83066a29621647cf82f54981440927a09eeb3fcf74
MD5 a677aeadaa5e74f912340966966a34e7
SHA1 5583afa2b1ff1ace7e9f1df0116016e4bd7bfa11
SHA512 36b818f3a50b1197ab8d429520d75a4c6bf7cdbc938826f6454265ab71387fa1161e8618c8955f0bc20abceb06a594f3697118f2fe7cee9b3ed5cfb4b5a66914
SSDEEP 12288:h7hfV/PYgbAMtmdPrmbBddeJ8UW6AFWYdhN3Xyk:/NnYg3QWUW6hYRy
TLSH
T16715F9B03A99187BC5DB6134E520E5B3CCE234BA079DE7935B6024D41EEB5F8687334A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-19_a677aeadaa5e74f912340966966a34e7_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader

File Explorer

2026-10-19_a677aeadaa5e74f912340966966a34e7_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader

.exe 873KB

2026-10-19_a677aeadaa5e74f912340966966a34e7_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader

IMPHASH db1aa58ba91d9988e77855d1e5859752
SHA256 11c94f8edfb979f75c2d2b83066a29621647cf82f54981440927a09eeb3fcf74
MD5 a677aeadaa5e74f912340966966a34e7
SHA1 5583afa2b1ff1ace7e9f1df0116016e4bd7bfa11
SHA512 36b818f3a50b1197ab8d429520d75a4c6bf7cdbc938826f6454265ab71387fa1161e8618c8955f0bc20abceb06a594f3697118f2fe7cee9b3ed5cfb4b5a66914
SSDEEP 12288:h7hfV/PYgbAMtmdPrmbBddeJ8UW6AFWYdhN3Xyk:/NnYg3QWUW6hYRy
TLSH
T16715F9B03A99187BC5DB6134E520E5B3CCE234BA079DE7935B6024D41EEB5F8687334A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

418312

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

AcquireSRWLockExclusive CancelIo CloseHandle CompareStringW CreateEventA CreateEventW CreateFileA CreateFileW CreateMutexW CreateProcessA CreateProcessW CreateRemoteThread CreateThread CreateToolhelp32Snapshot CreateWaitableTimerW DecodePointer DeleteCriticalSection DeleteFileA DeleteFileW DeviceIoControl EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsW FindClose FindFirstFileExW FindFirstFileW FindNextFileW FindResourceExW FindResourceW FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetConsoleWindow GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDiskFreeSpaceExW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesA GetFileAttributesW GetFileSize GetFileSizeEx GetFileType GetLastError GetLocalTime GetLocaleInfoW GetLogicalDriveStringsW GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetProcessId GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryA GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetTickCount GetTimeZoneInformation GetUserDefaultLCID GetVersionExW GlobalAlloc GlobalFree GlobalLock GlobalMemoryStatusEx GlobalSize GlobalUnlock HeapAlloc HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsBadReadPtr IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale K32EnumDeviceDrivers K32GetDeviceDriverBaseNameA K32GetProcessImageFileNameW LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LoadResource LocalAlloc LocalFree LockResource MultiByteToWideChar OpenMutexW OpenProcess OutputDebugStringW Process32FirstW Process32NextW QueryDosDeviceW QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReleaseMutex ReleaseSRWLockExclusive ResetEvent ResumeThread RtlUnwind SetComputerNameExW SetEnvironmentVariableW SetEvent SetFilePointer SetFilePointerEx SetLastError SetStdHandle SetThreadContext SetThreadExecutionState SetUnhandledExceptionFilter SetWaitableTimer SizeofResource Sleep SleepConditionVariableSRW SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter VirtualAlloc VirtualAllocEx VirtualFree VirtualProtect VirtualProtectEx VirtualQuery WTSGetActiveConsoleSessionId WaitForSingleObject WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile WriteProcessMemory lstrcatW lstrcmpW lstrcmpiW lstrcpyW lstrlenA lstrlenW

user32

BeginPaint CallNextHookEx CopyIcon CreateCursor CreateWindowExW DefWindowProcW DestroyCursor DestroyWindow DispatchMessageW EndPaint EnumDisplayMonitors EnumWindows ExitWindowsEx FindWindowW GetAsyncKeyState GetClientRect GetClipboardSequenceNumber GetDC GetDesktopWindow GetForegroundWindow GetInputState GetKeyState GetLastInputInfo GetMonitorInfoW GetSystemMetrics GetWindowTextW IsClipboardFormatAvailable IsWindow IsWindowVisible MsgWaitForMultipleObjects OpenDesktopW PeekMessageW PostMessageW PostThreadMessageA RegisterClassExW ReleaseDC SendInput SendMessageW SetLayeredWindowAttributes SetSystemCursor SetThreadDesktop SetWindowDisplayAffinity SetWindowPos SetWindowsHookExW ShowWindow SwitchDesktop SystemParametersInfoW TranslateMessage UnhookWindowsHookEx UnregisterClassW UpdateWindow wsprintfW

ole32

CoCreateInstance CoGetObject CoInitialize CoInitializeEx CoUninitialize CreateStreamOnHGlobal GetHGlobalFromStream

gdi32

CreateCompatibleBitmap CreateCompatibleDC CreateDIBSection DeleteDC DeleteObject GetDIBits GetDeviceCaps GetObjectW GetStockObject SelectObject SetDIBColorTable SetStretchBltMode StretchBlt

advapi32

AdjustTokenPrivileges ClearEventLogW CloseEventLog CloseServiceHandle ControlService CreateServiceA CredEnumerateW CredFree DeleteService DuplicateTokenEx GetCurrentHwProfileW GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation LookupAccountSidW LookupPrivilegeValueW OpenEventLogW OpenProcessToken OpenSCManagerA OpenServiceA RegCloseKey RegCreateKeyExA RegCreateKeyExW RegCreateKeyW RegDeleteTreeA RegDeleteValueW RegEnumKeyExW RegEnumValueW RegOpenKeyExA RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegSetValueExA RegSetValueExW

oleaut32

SysAllocString SysFreeString SysStringLen

shell32

SHGetFolderPathW

ws2_32

WSACleanup WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAGetLastError WSAIoctl WSAResetEvent WSASetLastError WSAStartup WSAWaitForMultipleEvents closesocket connect gethostbyname gethostname htons inet_ntoa recv select send setsockopt shutdown socket

shlwapi

PathFileExistsA

bcrypt

BCryptGenRandom

winmm

timeGetTime

gdiplus

GdipAddPathArc GdipAlloc GdipBitmapLockBits GdipBitmapUnlockBits GdipCloneImage GdipCreateBitmapFromHBITMAP GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipCreateFont GdipCreateFontFamilyFromName GdipCreateFromHDC GdipCreatePath GdipCreatePen1 GdipCreateSolidFill GdipCreateStringFormat GdipDeleteBrush GdipDeleteFont GdipDeleteFontFamily GdipDeleteGraphics GdipDeletePath GdipDeletePen GdipDeleteStringFormat GdipDisposeImage GdipDrawEllipse GdipDrawImageI GdipDrawPath GdipDrawString GdipFillRectangleI GdipFree GdipGetImageEncoders GdipGetImageEncodersSize GdipGetImageGraphicsContext GdipGetImageHeight GdipGetImagePalette GdipGetImagePaletteSize GdipGetImagePixelFormat GdipGetImageWidth GdipSaveImageToStream GdipSetSmoothingMode GdipSetStringFormatAlign GdipSetTextRenderingHint GdiplusShutdown GdiplusStartup

dxgi

CreateDXGIFactory

dinput8

DirectInput8Create

Name

.text

Size

544KB

Virtual Size

548KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

78KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

224KB

Virtual Size

224KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-19_a677aeadaa5e74f912340966966a34e7_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader

kernel32

user32

ole32

gdi32

advapi32

oleaut32

shell32

ws2_32

shlwapi

bcrypt

winmm

gdiplus

dxgi

dinput8

generic