metasploit | 2026-11-03_a0041724d4503026e15fe8d59923344f_amadey_cobalt-strike_darkgate_elex_glassworm_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-03_a0041724d4503026e15fe8d59923344f_amadey_cobalt-strike_darkgate_elex_glassworm_luca-stealer_lynx_njrat
Size 833KB
Sample261104-pfz58act3j
SHA256 5ea69952304da6492da0fb7a80dc9ab0d4854339179abb1d4625585ed561b8b5
MD5 a0041724d4503026e15fe8d59923344f
SHA1 25421c1ae594ee12931161680ae5ab9d8fd3954a
SHA512 1e40b998740d828a10c7acd99eb9498a0d4be716b3a3e3baef7ba68304c03c7b74c7b8836026905c6efaa1289ae7ea33fa4feb46eb6c83878e6cf1eee4e9799b
SSDEEP 12288:2BhA3SfDkVs+k3mI62ATai/QqzlFCl7yZVrLnJtZsbTTeIhcUweLYMHRY:AiifDk0/AT71Cl7UpsX2Uworx
TLSH
T169059E02B6D18471F192017A0A3BF77E6E3DB1105B25C9C7C3E4D99899622E1EA3F35E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan backdoor metasploit

Malware Config

Extracted

Family

metasploit

Version

metasploit_stager

192.168.135.128:4444

Signatures

Family: MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-03_a0041724d4503026e15fe8d59923344f_amadey_cobalt-strike_darkgate_elex_glassworm_luca-stealer_lynx_njrat

File Explorer

2026-11-03_a0041724d4503026e15fe8d59923344f_amadey_cobalt-strike_darkgate_elex_glassworm_luca-stealer_lynx_njrat

.exe 833KB

2026-11-03_a0041724d4503026e15fe8d59923344f_amadey_cobalt-strike_darkgate_elex_glassworm_luca-stealer_lynx_njrat

IMPHASH 4e2502eead9c4f9bdce714ff55832165
SHA256 5ea69952304da6492da0fb7a80dc9ab0d4854339179abb1d4625585ed561b8b5
MD5 a0041724d4503026e15fe8d59923344f
SHA1 25421c1ae594ee12931161680ae5ab9d8fd3954a
SHA512 1e40b998740d828a10c7acd99eb9498a0d4be716b3a3e3baef7ba68304c03c7b74c7b8836026905c6efaa1289ae7ea33fa4feb46eb6c83878e6cf1eee4e9799b
SSDEEP 12288:2BhA3SfDkVs+k3mI62ATai/QqzlFCl7yZVrLnJtZsbTTeIhcUweLYMHRY:AiifDk0/AT71Cl7UpsX2Uworx
TLSH
T169059E02B6D18471F192017A0A3BF77E6E3DB1105B25C9C7C3E4D99899622E1EA3F35E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

839680

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ClearCommBreak CloseHandle CompareStringW ConnectNamedPipe CreateEventA CreateFileA CreateFileMappingA CreateFileW CreateMutexA CreateNamedPipeA CreatePipe CreateProcessA CreateThread DecodePointer DeleteCriticalSection DeleteFileA EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileA FindFirstFileExW FindNextFileA FindNextFileW FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommState GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetEnvironmentStringsW GetEnvironmentVariableA GetFileSizeEx GetFileType GetLastError GetLocalTime GetLocaleInfoW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetOverlappedResult GetProcAddress GetProcessHeap GetProcessTimes GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryA GetSystemTimeAsFileTime GetThreadTimes GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetWindowsDirectoryA GlobalMemoryStatus HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW LocalAlloc LocalFileTimeToFileTime LocalFree MapViewOfFile MultiByteToWideChar OpenProcess OutputDebugStringW QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReleaseMutex RtlUnwind SetCommBreak SetCommState SetCommTimeouts SetConsoleMode SetEndOfFile SetEnvironmentVariableW SetEvent SetFilePointerEx SetHandleInformation SetLastError SetStdHandle SetUnhandledExceptionFilter TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter UnmapViewOfFile WaitForMultipleObjects WaitForSingleObject WaitNamedPipeA WideCharToMultiByte WriteConsoleW WriteFile

user32

FindWindowA GetCapture GetClipboardOwner GetCursorPos GetForegroundWindow GetQueueStatus SendMessageA

advapi32

AllocateAndInitializeSid CopySid EqualSid GetLengthSid GetUserNameA InitializeSecurityDescriptor RegCloseKey RegCreateKeyExA RegEnumKeyA RegOpenKeyA RegOpenKeyExA RegQueryValueExA RegSetValueExA SetSecurityDescriptorDacl SetSecurityDescriptorOwner

Name

.text

Size

591KB

Virtual Size

591KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

167KB

Virtual Size

166KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.voltbl

Size

512B

Virtual Size

156B

Characteristics

Name

.rsrc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.text

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

2026-11-03_a0041724d4503026e15fe8d59923344f_amadey_cobalt-strike_darkgate_elex_glassworm_luca-stealer_lynx_njrat

kernel32

user32

advapi32

generic