General
- Target 2026-04-05_13ef162691d868b1abbd8539983af2f0_amadey_cobalt-strike_elex_icedid_njrat_remcos_rhadamanthys_smoke-loader_stealc_tofsee
- Size 607KB
- Sample260405-cj4llac15v
- SHA256 05ae70ece185456528e5e8ce1f06fc5bc57ffca18d36b1b7de86124a38cb2d92
- MD5 13ef162691d868b1abbd8539983af2f0
- SHA1 9d161b8004148e6001deb8bc620fa8af91343f4c
- SHA512 b0a6df380fd914b6d2713e207eec33c1481baf5ca24386641e0d396df44432da83e7cf5eb2126289ee1a9791ce2e678c08e9d56419b1d453758941928191747b
- SSDEEP 12288:PM8eQ2nlMTq+KcWuuL1Jer5+n15ber5+nso:0fQJhKclsE
- TLSH T1F0D46B1373A1A8E2C6724F74AC2446D56737FC51AE2146A6792CA30E8F737C48F66F21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-05_13ef162691d868b1abbd8539983af2f0_amadey_cobalt-strike_elex_icedid_njrat_remcos_rhadamanth.exe
Resource
win10v2004-20260130-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-05_13ef162691d868b1abbd8539983af2f0_amadey_cobalt-strike_elex_icedid_njrat_remcos_rhadamanth.exe
Resource
win11-20260130-en
13 signatures
150 seconds
Malware Config
Extracted
Family
-
smokeloader
Botnet
-
lab
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://host-file-host6.com/
-
http://host-host-file8.com/
rc4.i32
rc4.i32
Targets
-
- Target 2026-04-05_13ef162691d868b1abbd8539983af2f0_amadey_cobalt-strike_elex_icedid_njrat_remcos_rhadamanthys_smoke-loader_stealc_tofsee
- Size 607KB
- SHA256 05ae70ece185456528e5e8ce1f06fc5bc57ffca18d36b1b7de86124a38cb2d92
- MD5 13ef162691d868b1abbd8539983af2f0
- SHA1 9d161b8004148e6001deb8bc620fa8af91343f4c
- SHA512 b0a6df380fd914b6d2713e207eec33c1481baf5ca24386641e0d396df44432da83e7cf5eb2126289ee1a9791ce2e678c08e9d56419b1d453758941928191747b
- SSDEEP 12288:PM8eQ2nlMTq+KcWuuL1Jer5+n15ber5+nso:0fQJhKclsE
- TLSH T1F0D46B1373A1A8E2C6724F74AC2446D56737FC51AE2146A6792CA30E8F737C48F66F21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Smokeloader family
-
Deletes itself
-
Suspicious use of SetThreadContext