2026-10-22_b1c2c09e07fa0b8dd1c09d3a0e0c55ad_amadey_cobalt-strike_darkgate_elex_glassworm_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_b1c2c09e07fa0b8dd1c09d3a0e0c55ad_amadey_cobalt-strike_darkgate_elex_glassworm_luca-stealer_lynx_njrat
Size 571KB
Sample261024-ae5xragx9k
SHA256 590f6e7b7c90b2e8901ffa255b777f2e58cf8a32e4a7eb80eff12cbbfe10432d
MD5 b1c2c09e07fa0b8dd1c09d3a0e0c55ad
SHA1 8f00bef0398f395a00b07a4b78d35f31384e579a
SHA512 92e9132714019e9f95f158968b890afd00ed8634af50b2e340f156d18078685eab2b09df80c81239ae10ffa6ff97bbc69c05b7d08924d20643160b0d157ca1ee
SSDEEP 12288:AVIIOFjPcZiY629Njgmmespb645Asac2LEUq0BxwXG3DtkFh8:FLyjMespb641qq0DWF+
TLSH
T16AC49E253866D476E57152F0292CABB581EEEC341B350ADBA7D01B2E5A242F33F31D36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-22_b1c2c09e07fa0b8dd1c09d3a0e0c55ad_amadey_cobalt-strike_darkgate_elex_glassworm_luca-stealer_lynx_njrat

.exe 571KB

2026-10-22_b1c2c09e07fa0b8dd1c09d3a0e0c55ad_amadey_cobalt-strike_darkgate_elex_glassworm_luca-stealer_lynx_njrat

IMPHASH 20ee478ccae44b438dab718e98bd3878
SHA256 590f6e7b7c90b2e8901ffa255b777f2e58cf8a32e4a7eb80eff12cbbfe10432d
MD5 b1c2c09e07fa0b8dd1c09d3a0e0c55ad
SHA1 8f00bef0398f395a00b07a4b78d35f31384e579a
SHA512 92e9132714019e9f95f158968b890afd00ed8634af50b2e340f156d18078685eab2b09df80c81239ae10ffa6ff97bbc69c05b7d08924d20643160b0d157ca1ee
SSDEEP 12288:AVIIOFjPcZiY629Njgmmespb645Asac2LEUq0BxwXG3DtkFh8:FLyjMespb641qq0DWF+
TLSH
T16AC49E253866D476E57152F0292CABB581EEEC341B350ADBA7D01B2E5A242F33F31D36
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

27:b1:2c:a9:f9:d4:04:e7:bb:64:a8:fd:c8:2b:87:ac:33:c1:cf:ff:43:56:17:aa:66:78:05:cf:38:37:0b:13

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=SC252676,CN=N-ABLE TECHNOLOGIES LTD,O=N-ABLE TECHNOLOGIES LTD,L=Dundee,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 15, 2026

SERIALNUMBER=SC252676,CN=N-ABLE TECHNOLOGIES LTD,O=N-ABLE TECHNOLOGIES LTD,L=Dundee,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=SC252676,CN=N-ABLE TECHNOLOGIES LTD,O=N-ABLE TECHNOLOGIES LTD,L=Dundee,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

SERIALNUMBER=SC252676,CN=N-ABLE TECHNOLOGIES LTD,O=N-ABLE TECHNOLOGIES LTD,L=Dundee,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

03:40:78:24:36:70:99:c9:ca:b8:a0:8d:c3:91:2c:41

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 20, 2026 - Jun 21, 2027

Minor OS version

Major OS version

Entry point

269821

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\home\jenkins\agent\workspace\Modules_tc-win-agent-modules_dev\RemoteAudioHelper\Release\TCRmtAudioHelper.pdb

libcrypto-3

EVP_EncryptInit_ex EVP_DecryptUpdate EVP_CIPHER_CTX_new EVP_PKEY_set1_EC_KEY EVP_PKEY_paramgen EC_KEY_new_by_curve_name EVP_DecryptInit_ex EVP_PKEY_CTX_new EC_KEY_get0_group EVP_PKEY_CTX_set_ec_paramgen_curve_nid EVP_PKEY_derive EC_POINT_point2oct EVP_PKEY_derive_init EVP_CIPHER_CTX_reset EC_GROUP_new_by_curve_name EC_POINT_new EVP_MD_CTX_new EVP_sha256 EVP_DigestUpdate EVP_MD_CTX_free EVP_DigestInit_ex EVP_DigestFinal_ex OSSL_PARAM_construct_uint RAND_bytes EVP_KDF_derive EVP_KDF_CTX_new EVP_KDF_CTX_free EVP_MAC_CTX_new OSSL_PARAM_construct_octet_string EVP_MAC_CTX_free OSSL_PARAM_construct_utf8_string EVP_MAC_final EVP_MAC_init OSSL_PARAM_construct_end EVP_MAC_update OSSL_PROVIDER_self_test EVP_MD_fetch BIO_new EVP_EncryptUpdate EVP_MAC_fetch BIO_ctrl OSSL_PARAM_locate_const EVP_CIPHER_fetch OPENSSL_init_crypto ERR_print_errors_fp ERR_print_errors BIO_s_mem OSSL_PROVIDER_do_all BIO_free OSSL_PROVIDER_get0_name OSSL_PROVIDER_load CONF_modules_load_file EVP_KDF_fetch OpenSSL_version OSSL_PROVIDER_get_params OSSL_PROVIDER_unload OSSL_PROVIDER_set_default_search_path OSSL_SELF_TEST_set_callback EC_POINT_oct2point EVP_PKEY_CTX_free EVP_PKEY_CTX_new_id EVP_PKEY_get1_EC_KEY EVP_PKEY_new EC_GROUP_clear_free EVP_PKEY_derive_set_peer EC_KEY_set_public_key CRYPTO_malloc EC_POINT_clear_free EVP_PKEY_keygen_init EC_KEY_free EVP_PKEY_paramgen_init EVP_PKEY_keygen EVP_PKEY_free EC_KEY_get0_public_key EVP_CIPHER_CTX_set_padding

shlwapi

PathFileExistsA

avrt

AvRevertMmThreadCharacteristics AvSetMmThreadCharacteristicsW

opus

opus_encoder_create opus_decode_float opus_get_version_string opus_encode_float opus_encoder_destroy opus_decoder_create opus_decoder_destroy opus_encoder_ctl opus_decode opus_encode

ole32

CoInitializeEx CoCreateInstance CoUninitialize CoTaskMemFree

oleaut32

VariantClear

kernel32

SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation GetFileSizeEx SetEndOfFile SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW HeapAlloc HeapFree HeapReAlloc GetCommandLineW GetCommandLineA GetStdHandle GetModuleFileNameW GetModuleHandleExW ExitProcess SetFilePointerEx GetConsoleOutputCP GetFileType CreateFileW ReadConsoleW GetProcessHeap LoadLibraryExW GetProcAddress FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc SetLastError RaiseException RtlUnwind InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo CompareStringEx GetLocaleInfoEx LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx GetStringTypeW LocalFree FormatMessageA CreateDirectoryA CreateSemaphoreW UnlockFile GetLocalTime OutputDebugStringW WriteConsoleW GetConsoleMode InitializeCriticalSectionAndSpinCount SetFilePointer LockFile ReleaseSemaphore GetShortPathNameA WideCharToMultiByte GetModuleHandleW MultiByteToWideChar GetCurrentProcess GetModuleFileNameA SetEvent WaitForMultipleObjects lstrlenW CreateEventExW PeekNamedPipe ReadFile FlushFileBuffers GetCurrentProcessId DeleteCriticalSection CreateThread CloseHandle SetEnvironmentVariableA GetNamedPipeServerSessionId SetNamedPipeHandleState WaitNamedPipeA EnterCriticalSection WriteFile HeapSize LeaveCriticalSection WaitForSingleObject ProcessIdToSessionId Sleep GetTickCount64 GetLastError CreateFileA

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_b1c2c09e07fa0b8dd1c09d3a0e0c55ad_amadey_cobalt-strike_darkgate_elex_glassworm_luca-stealer_lynx_njrat

libcrypto-3

shlwapi

avrt

opus

ole32

oleaut32

kernel32

generic