General
- Target 2026-04-06_dd7952497f7149deed4c1e0a9e2d4df4_amadey_cobalt-strike_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 323KB
- Sample260406-29gl7af19y
- SHA256 17b9d798f26311a4fd792f466adb3000b1360c07e4900d9540deea149a985a61
- MD5 dd7952497f7149deed4c1e0a9e2d4df4
- SHA1 509b3d86065bb28f424353b42f794e5738c3a0d3
- SHA512 9ff53fdc036a65b4fea3be269775f34df37ba3e8b106b7a1eb51050880d9be33beb8362bcf542f550af70f900162573ee318d00232522eb4f51eed8f839d9b7b
- SSDEEP 6144:UooLdH1wJCLP6hAE4jg1pSwiBF7hfHq8OSqer5+nDFoT:sRH1wJCGhUjgGwiv7hfH0er5+nZo
- TLSH T16864AD0E3654A4F3D6724F30A82899D16B3768637F500AE77AD4134E8D623F89F67B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-06_dd7952497f7149deed4c1e0a9e2d4df4_amadey_cobalt-strike_elex_njrat_redline-stealer_rhadaman.exe
Resource
win10v2004-20260130-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-06_dd7952497f7149deed4c1e0a9e2d4df4_amadey_cobalt-strike_elex_njrat_redline-stealer_rhadaman.exe
Resource
win11-20260130-en
12 signatures
150 seconds
Malware Config
Extracted
Family
-
smokeloader
Botnet
-
lab
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://host-file-host6.com/
-
http://host-host-file8.com/
rc4.i32
rc4.i32
Targets
-
- Target 2026-04-06_dd7952497f7149deed4c1e0a9e2d4df4_amadey_cobalt-strike_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 323KB
- SHA256 17b9d798f26311a4fd792f466adb3000b1360c07e4900d9540deea149a985a61
- MD5 dd7952497f7149deed4c1e0a9e2d4df4
- SHA1 509b3d86065bb28f424353b42f794e5738c3a0d3
- SHA512 9ff53fdc036a65b4fea3be269775f34df37ba3e8b106b7a1eb51050880d9be33beb8362bcf542f550af70f900162573ee318d00232522eb4f51eed8f839d9b7b
- SSDEEP 6144:UooLdH1wJCLP6hAE4jg1pSwiBF7hfHq8OSqer5+nDFoT:sRH1wJCGhUjgGwiv7hfH0er5+nZo
- TLSH T16864AD0E3654A4F3D6724F30A82899D16B3768637F500AE77AD4134E8D623F89F67B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Smokeloader family
-
Deletes itself
-
Suspicious use of SetThreadContext