2026-11-01_b9998968db80c814d9d89fbee5eea013_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_b9998968db80c814d9d89fbee5eea013_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat_smoke-loader
Size 812KB
Sample261102-ml9whavt7m
SHA256 6670084a935ab5c28c3f849a6af36687fd3419676b655ad7d36d4715f38412ae
MD5 b9998968db80c814d9d89fbee5eea013
SHA1 aa1feef1e7d73870ab5ea1979db8290e24e63ca0
SHA512 e5c8148914bf01005c9794f3b1875426bab1f38d9e6833b622d7b2f6542335bb5172bf582964c9204a0623891c56f74470410f6baf7bdf8f30471b91f165c8a3
SSDEEP 24576:ZMFO2CgFYPCCfEAYrAkrMNjsY+NTN7MDO9PadHCVagYrEH7Y:WFdFYlf1YtrMVsY+NTN7MDO9PadHGagw
TLSH
T186058D207501C17BD56111B1A86EAFF650ADA93B4B7709C7B3894B3D5E782C32F31A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_b9998968db80c814d9d89fbee5eea013_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat_smoke-loader

File Explorer

2026-11-01_b9998968db80c814d9d89fbee5eea013_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat_smoke-loader

.exe 812KB

2026-11-01_b9998968db80c814d9d89fbee5eea013_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat_smoke-loader

IMPHASH fb650db35bb52873770df0e4705d9ada
SHA256 6670084a935ab5c28c3f849a6af36687fd3419676b655ad7d36d4715f38412ae
MD5 b9998968db80c814d9d89fbee5eea013
SHA1 aa1feef1e7d73870ab5ea1979db8290e24e63ca0
SHA512 e5c8148914bf01005c9794f3b1875426bab1f38d9e6833b622d7b2f6542335bb5172bf582964c9204a0623891c56f74470410f6baf7bdf8f30471b91f165c8a3
SSDEEP 24576:ZMFO2CgFYPCCfEAYrAkrMNjsY+NTN7MDO9PadHCVagYrEH7Y:WFdFYlf1YtrMVsY+NTN7MDO9PadHGagw
TLSH
T186058D207501C17BD56111B1A86EAFF650ADA93B4B7709C7B3894B3D5E782C32F31A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

320175

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

powrprof

CallNtPowerInformation

user32

RegisterClassW GetMessageW TranslateMessage DispatchMessageW PostMessageW DefWindowProcW GetWindowLongW UnregisterClassW CreateWindowExW DestroyWindow SetWindowLongW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

winhttp

WinHttpWriteData WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryHeaders WinHttpSetTimeouts WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest WinHttpReceiveResponse

advapi32

SystemFunction036 ConvertStringSecurityDescriptorToSecurityDescriptorW BuildExplicitAccessWithNameW BuildSecurityDescriptorW RevertToSelf ImpersonateNamedPipeClient RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegCloseKey

kernel32

RemoveDirectoryW GetFileTime CreateProcessW InitializeCriticalSection Sleep SleepEx AddVectoredExceptionHandler GetFileAttributesW DeleteFileW CreateDirectoryW WriteConsoleW GetProcessHeap SetStdHandle InitOnceBeginInitialize InitOnceComplete GetDriveTypeW GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetCurrentDirectoryW SetEndOfFile SetUnhandledExceptionFilter SetProcessShutdownParameters SetConsoleCtrlHandler GetProcessTimes SuspendThread ResumeThread GetProcessId GetThreadContext VerSetConditionMask IsProcessorFeaturePresent GetSystemInfo VerifyVersionInfoW GetTimeZoneInformation GetThreadLocale GetSystemDefaultLCID GetUserDefaultLCID GetModuleFileNameW DuplicateHandle GetLastError ConnectNamedPipe DisconnectNamedPipe CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus SetEvent WaitForSingleObject CreateEventW GetCurrentProcess CreateThread OpenProcess UnregisterWaitEx RegisterWaitForSingleObject GetFileInformationByHandleEx SetLastError IsWow64Process GetModuleHandleW FormatMessageA VirtualQueryEx ReadProcessMemory GetSystemTimeAsFileTime GetProcAddress LoadLibraryW FindClose CloseHandle RemoveVectoredExceptionHandler LocalFree CreateFileW SetNamedPipeHandleState TransactNamedPipe CreateNamedPipeW WaitNamedPipeW GetVersion TerminateProcess ReleaseSemaphore CreateSemaphoreW GetStdHandle GetFileSizeEx GetFileType LockFileEx ReadFile GetFullPathNameW SetFilePointerEx UnlockFileEx WriteFile OutputDebugStringW GetCurrentProcessId GetCurrentThreadId GetLocalTime FormatMessageW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEnvironmentVariableW WideCharToMultiByte InitializeCriticalSectionEx EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter QueryPerformanceCounter InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind RaiseException TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetCommandLineA GetCommandLineW ExitProcess GetModuleHandleExW HeapAlloc HeapFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale EnumSystemLocalesW HeapReAlloc HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW

Name

.text

Size

537KB

Virtual Size

537KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

162KB

Virtual Size

162KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_b9998968db80c814d9d89fbee5eea013_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat_smoke-loader

powrprof

user32

version

winhttp

advapi32

kernel32

generic