2026-11-07_08313404f62055a7569822f054cbdabc_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-07_08313404f62055a7569822f054cbdabc_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat
Size 378KB
Sample261107-vtl4eaev5l
SHA256 ecba697c510ebe0decb23953f8e320809699003eb2361ae306911739f91ef230
MD5 08313404f62055a7569822f054cbdabc
SHA1 c8d9ac73733ce652a5230203d2a2c636ae7a5d96
SHA512 3285919b4d5eafbe03cc7cce73e2ee50b2cb2ff52c762ffce0671c8e5c757676dbb485bab9881565ddc1b60bfcf80885b298b1392a2aea9ab7d53111c326cbc0
SSDEEP 6144:2YT6VSeL+8+PWfsq/iL+Q8vB8wII7QEyuwhGqSVrkKE2A+ZDblF9LUPflGBV+Udt:2k6cd7PKsq658v2zI7QEyuwgqqDRF9Lv
TLSH
T1B584AE00F540D2F6D8A1007576FD6BB699ACA63D1F2640D7A39414BE9A281D3AF39F0F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-11-07_08313404f62055a7569822f054cbdabc_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

File Explorer

2026-11-07_08313404f62055a7569822f054cbdabc_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

.exe 378KB

2026-11-07_08313404f62055a7569822f054cbdabc_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

IMPHASH 8d5f0c9d3ed9d8d34f4bc33cb0567a64
SHA256 ecba697c510ebe0decb23953f8e320809699003eb2361ae306911739f91ef230
MD5 08313404f62055a7569822f054cbdabc
SHA1 c8d9ac73733ce652a5230203d2a2c636ae7a5d96
SHA512 3285919b4d5eafbe03cc7cce73e2ee50b2cb2ff52c762ffce0671c8e5c757676dbb485bab9881565ddc1b60bfcf80885b298b1392a2aea9ab7d53111c326cbc0
SSDEEP 6144:2YT6VSeL+8+PWfsq/iL+Q8vB8wII7QEyuwhGqSVrkKE2A+ZDblF9LUPflGBV+Udt:2k6cd7PKsq658v2zI7QEyuwgqqDRF9Lv
TLSH
T1B584AE00F540D2F6D8A1007576FD6BB699ACA63D1F2640D7A39414BE9A281D3AF39F0F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

c0:35:72:43:f8:16:68:e4:b9:b7:4b:79:e9:a8:fa:ac:cb:04:05:1a:de:9a:77:51:c0:f3:c6:42:69:72:5a:c0

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=7954709,CN=CLEVERFILES INC.,O=CLEVERFILES INC.,ST=Delaware,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Dec 2, 2022

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

Serial Number

39:26:6d:5e:de:6a:49:dd:26:44:c7:55:3e:79:43:92

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 6, 2022 - May 5, 2025

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 11, 2022 - Aug 10, 2033

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

153837

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\lazyden\self\DiskDrillWin\DD4\bin\cfbackd\x86\Release\cfbackd.pdb

kernel32

ReadFile GetVolumeInformationW GetVolumeNameForVolumeMountPointW GetFileAttributesExW GetVolumePathNamesForVolumeNameW GetFileInformationByHandle EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection OpenProcess DuplicateHandle GetCurrentProcess ResetEvent WaitForSingleObject DecodePointer SetEndOfFile WriteConsoleW HeapSize GetProcessHeap GetStringTypeW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo CreateThread GetSystemTimeAsFileTime DeleteFileA MoveFileExA GetFileAttributesExA CreateFileW DeviceIoControl CreateFileA GetFileSizeEx LocalFree SetFileAttributesW GetTickCount GetModuleHandleW CloseHandle SetEvent GetLastError Sleep CreateEventW GetModuleFileNameW SetConsoleCtrlHandler GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetConsoleOutputCP SetStdHandle MoveFileW GetLocalTime DeleteFileW GetFileAttributesW CreateDirectoryW RemoveDirectoryW CreateIoCompletionPort SetLastError HeapDestroy PostQueuedCompletionStatus HeapCreate HeapSetInformation HeapAlloc HeapFree GetModuleHandleExW FormatMessageA FlushFileBuffers WriteFile FindFirstFileW FindNextFileW FindClose DisconnectNamedPipe GetCurrentProcessId CreateNamedPipeW ConnectNamedPipe ReadDirectoryChangesW InitializeCriticalSectionAndSpinCount ResumeThread QueueUserAPC TerminateThread GetCurrentThreadId WaitForMultipleObjectsEx SleepEx ExitThread GetSystemInfo OpenThread GetQueuedCompletionStatus SetFileAttributesA SetFilePointerEx GetFileSize CreateFileMappingW MapViewOfFile UnmapViewOfFile TlsAlloc TlsFree TlsGetValue TlsSetValue FreeLibraryAndExitThread UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind FreeLibrary GetProcAddress LoadLibraryExW RaiseException GetConsoleCP GetStdHandle ExitProcess GetCommandLineA GetCommandLineW CompareStringW LCMapStringW GetFileType WideCharToMultiByte GetConsoleMode SetConsoleMode GetNumberOfConsoleInputEvents ReadConsoleInputW PeekConsoleInputA ReadConsoleW HeapReAlloc MultiByteToWideChar MoveFileExW

user32

GetWindowLongW RegisterDeviceNotificationW DestroyWindow CreateWindowExW UnregisterClassW RegisterClassExW SetWindowLongW MsgWaitForMultipleObjects DispatchMessageW PeekMessageW TranslateMessage UnregisterDeviceNotification DefWindowProcW

advapi32

SetSecurityDescriptorDacl GetSecurityDescriptorDacl ConvertStringSecurityDescriptorToSecurityDescriptorW SetNamedSecurityInfoA SetNamedSecurityInfoW CreateServiceW CloseServiceHandle OpenSCManagerW ChangeServiceConfig2W RegCreateKeyExW DeleteService ControlService StartServiceW RegOpenKeyExW ChangeServiceConfigW OpenServiceW QueryServiceStatusEx RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW RegCloseKey RegQueryValueExW RegSetValueExW InitializeSecurityDescriptor

ole32

CoUninitialize CoInitializeEx CoTaskMemFree StringFromGUID2

setupapi

SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW SetupDiGetDeviceInterfaceDetailW

shell32

SHGetKnownFolderPath

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-07_08313404f62055a7569822f054cbdabc_amadey_cobalt-strike_elex_floxif_luca-stealer_lynx_njrat

PE Signature issue

kernel32

user32

advapi32

ole32

setupapi

shell32

version

generic