2026-11-06_c6ceb9b8a9b8b44c0552a3c60236af18_amadey_cobalt-strike_elex_luca-stealer_lynx_metamorfo_njrat

General

Target
2026-11-06_c6ceb9b8a9b8b44c0552a3c60236af18_amadey_cobalt-strike_elex_luca-stealer_lynx_metamorfo_njrat
Size 200KB
Sample261107-3ty2zagx3j
SHA256 858b1cd7c71aef65f2822c9e42130ad1892483d8399be50079258a55b41f7eed
MD5 c6ceb9b8a9b8b44c0552a3c60236af18
SHA1 c0c21584a9ac96f233afbd223add1faeb0d0fd0f
SHA512 58d077ac030d8d958dc3fbe5479d6b027872e33c0052895405b80781220ffb644409154c56d97fcf4a450fde16bae0d71287aba8f27ecd4c87e1a5cec29da05e
SSDEEP 6144:KdcppjI6Ny1ly+/7A9j+6ogYAOkmo+dG:Kdcvy1I+/7pGYxRG
TLSH
T151148D20B4D1C432D4B314360EF8DAB99A3C76700B9658EFA3D80FAE5F646D2B631567
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-06_c6ceb9b8a9b8b44c0552a3c60236af18_amadey_cobalt-strike_elex_luca-stealer_lynx_metamorfo_njrat

File Explorer

2026-11-06_c6ceb9b8a9b8b44c0552a3c60236af18_amadey_cobalt-strike_elex_luca-stealer_lynx_metamorfo_njrat

.exe 200KB

2026-11-06_c6ceb9b8a9b8b44c0552a3c60236af18_amadey_cobalt-strike_elex_luca-stealer_lynx_metamorfo_njrat

IMPHASH 199d4e8bfb0ba9fbe37238c1f0c6381f
SHA256 858b1cd7c71aef65f2822c9e42130ad1892483d8399be50079258a55b41f7eed
MD5 c6ceb9b8a9b8b44c0552a3c60236af18
SHA1 c0c21584a9ac96f233afbd223add1faeb0d0fd0f
SHA512 58d077ac030d8d958dc3fbe5479d6b027872e33c0052895405b80781220ffb644409154c56d97fcf4a450fde16bae0d71287aba8f27ecd4c87e1a5cec29da05e
SSDEEP 6144:KdcppjI6Ny1ly+/7A9j+6ogYAOkmo+dG:Kdcvy1I+/7pGYxRG
TLSH
T151148D20B4D1C432D4B314360EF8DAB99A3C76700B9658EFA3D80FAE5F646D2B631567
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

48291

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GlobalMemoryStatusEx Sleep FindFirstFileA FindNextFileA GetTempPathA WideCharToMultiByte ReadFile GetFileSizeEx FindClose GetLastError CreateFileA CloseHandle VirtualAlloc CopyFileA CreateProcessA DecodePointer WriteConsoleW SetEndOfFile ReadConsoleW CreateFileW HeapReAlloc HeapSize GetStringTypeW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead MultiByteToWideChar LocalFree RtlUnwind RaiseException SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile HeapAlloc HeapFree CompareStringW LCMapStringW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx FindFirstFileExW

ole32

CoCreateInstance CoInitializeSecurity CoInitializeEx CoSetProxyBlanket CoUninitialize

oleaut32

SysAllocString VariantClear SysFreeString

ws2_32

setsockopt htons inet_ntop recv connect closesocket WSAStartup inet_addr send socket

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-06_c6ceb9b8a9b8b44c0552a3c60236af18_amadey_cobalt-strike_elex_luca-stealer_lynx_metamorfo_njrat

kernel32

ole32

oleaut32

ws2_32

generic