2026-04-05_d4c404f2959d81b7cf51daeb8aaa1ecd_amadey_cobalt-strike_elex_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee

General

Target
2026-04-05_d4c404f2959d81b7cf51daeb8aaa1ecd_amadey_cobalt-strike_elex_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee
Size 794KB
Sample260405-eexzcshw9r
SHA256 9a0fa1db6ace20bfa9f3460d5d8fbb286a9c22f349c75385a96b49f684b3983f
MD5 d4c404f2959d81b7cf51daeb8aaa1ecd
SHA1 5a8e3416530d40d52295ee612271671ae3a2a0b9
SHA512 f30bb481db7a9caab86f4a7985e6e5017a05df4b5a2bba1cd512e15c348d968fbd99146c432a2ed694db898afa610f7758a7e44097310fb0c37a714a51587eb1
SSDEEP 24576:Uk8hfZIvuQHoYa4hk7x/wCYPEFosL20w:otZIvuQIYLhclQPqos
TLSH
T13605021D7AA5D8E2DA328D30AC20CCA1663B7C939A515AB726C4230E6D735F44E37F34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-05_d4c404f2959d81b7cf51daeb8aaa1ecd_amadey_cobalt-strike_elex_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee

File Explorer

2026-04-05_d4c404f2959d81b7cf51daeb8aaa1ecd_amadey_cobalt-strike_elex_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee

.exe 794KB

2026-04-05_d4c404f2959d81b7cf51daeb8aaa1ecd_amadey_cobalt-strike_elex_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee

IMPHASH 71666ce513898b08ba38dfa1dc35ec76
SHA256 9a0fa1db6ace20bfa9f3460d5d8fbb286a9c22f349c75385a96b49f684b3983f
MD5 d4c404f2959d81b7cf51daeb8aaa1ecd
SHA1 5a8e3416530d40d52295ee612271671ae3a2a0b9
SHA512 f30bb481db7a9caab86f4a7985e6e5017a05df4b5a2bba1cd512e15c348d968fbd99146c432a2ed694db898afa610f7758a7e44097310fb0c37a714a51587eb1
SSDEEP 24576:Uk8hfZIvuQHoYa4hk7x/wCYPEFosL20w:otZIvuQIYLhclQPqos
TLSH
T13605021D7AA5D8E2DA328D30AC20CCA1663B7C939A515AB726C4230E6D735F44E37F34
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

18942

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\gesip-mebadejita\cugikoganebac8.pdb

kernel32

ReadConsoleA InterlockedDecrement WaitNamedPipeA SetFirmwareEnvironmentVariableA GetUserDefaultLCID InterlockedCompareExchange GetModuleHandleW EnumCalendarInfoExW SetCommState EnumResourceTypesA TlsSetValue FindResourceExA LoadLibraryW GetVersionExW DeleteVolumeMountPointW GetFileAttributesA SetConsoleMode GetConsoleAliasW HeapValidate SetConsoleCursorPosition GetMailslotInfo WritePrivateProfileStringW GetStringTypeExA CreateJobObjectA GetProfileIntA GetCPInfoExW GetCommState GetLastError InterlockedFlushSList GetProcAddress VirtualAlloc BackupWrite WriteProfileSectionA RemoveDirectoryA SetStdHandle LocalAlloc MoveFileA AddAtomW BeginUpdateResourceA FoldStringA GetModuleHandleA FreeEnvironmentStringsW VirtualProtect OpenEventW QueryPerformanceFrequency GetShortPathNameW GetWindowsDirectoryW AddConsoleAliasA GetConsoleProcessList DebugBreak DeleteFileA VerSetConditionMask GetConsoleAliasesLengthW UnhandledExceptionFilter SetUnhandledExceptionFilter HeapFree MultiByteToWideChar GetCommandLineA GetStartupInfoA Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA TerminateProcess GetCurrentProcess IsDebuggerPresent HeapAlloc HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc GetCPInfo InterlockedIncrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsFree SetLastError GetCurrentThreadId FreeEnvironmentStringsA GetEnvironmentStrings WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind RaiseException LoadLibraryA InitializeCriticalSectionAndSpinCount LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize

user32

CharLowerBuffW

gdi32

SelectPalette GetCharWidthI

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-05_d4c404f2959d81b7cf51daeb8aaa1ecd_amadey_cobalt-strike_elex_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee

kernel32

user32

gdi32

generic