stealc | 2025-12-01_8a43d16afd320aed17f45c08eca43742_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

General

Target
2025-12-01_8a43d16afd320aed17f45c08eca43742_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader
Size 648KB
Sample251201-e94qdswlbm
SHA256 89c776ff1a7a0880d1d50c3a66087c055cc0fa4e0db92ce7c2cebd2da24a089e
MD5 8a43d16afd320aed17f45c08eca43742
SHA1 c0f62f808871618da0accf45d6764898001616c8
SHA512 b04bfd31b355e4317ad78d41fc3bd5d391f1b23629128442e861d7ef33600afe655e4d096d2e6d4a2d0a7b31a98d69b21abd3fcbe35686115c43695fb5a9ae14
SSDEEP 12288:sSdGuEPgFaX2YPeynCHaD9BqTSv3YZtF15kjH0otVz:nEuE52YWynCC9kTG3ztV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

upted1 stealc

Malware Config

Extracted

Family

stealc

Botnet

upted1

C2

http://185.242.245.40

Attributes

url_path
/2cce982337eb4e69.php

rc4.plain

Signatures

Stealc family
stealc

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2025-12-01_8a43d16afd320aed17f45c08eca43742_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

File Explorer

2025-12-01_8a43d16afd320aed17f45c08eca43742_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

.exe 648KB

2025-12-01_8a43d16afd320aed17f45c08eca43742_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

IMPHASH f65ed848807002ce3dcd9fabd3861ae6
SHA256 89c776ff1a7a0880d1d50c3a66087c055cc0fa4e0db92ce7c2cebd2da24a089e
MD5 8a43d16afd320aed17f45c08eca43742
SHA1 c0f62f808871618da0accf45d6764898001616c8
SHA512 b04bfd31b355e4317ad78d41fc3bd5d391f1b23629128442e861d7ef33600afe655e4d096d2e6d4a2d0a7b31a98d69b21abd3fcbe35686115c43695fb5a9ae14
SSDEEP 12288:sSdGuEPgFaX2YPeynCHaD9BqTSv3YZtF15kjH0otVz:nEuE52YWynCC9kTG3ztV
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

95844

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrcatW GetModuleFileNameA LoadLibraryA GetProcAddress GetCurrentProcess CloseHandle QueryPerformanceCounter QueryPerformanceFrequency Sleep GetCurrentThreadId MultiByteToWideChar GetStringTypeW GetLocaleInfoEx WideCharToMultiByte InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RaiseException RtlUnwind GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle GetFileType GetModuleFileNameW GetModuleHandleExW WriteConsoleW ExitProcess WriteFile HeapFree HeapAlloc OutputDebugStringW GetTimeZoneInformation FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize CreateFileW

Sharing