General
- Target 2026-04-06_2a0391be5c3f07dad8a44fedc8dcdefb_amadey_cobalt-strike_elex_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stop_tofsee
- Size 332KB
- Sample260406-k4htmahw9w
- SHA256 878d90f6c62720bec0171f8b560ec8af39015c1561e1ffc2a84bbc5e20294d6b
- MD5 2a0391be5c3f07dad8a44fedc8dcdefb
- SHA1 c34141ef5d2e87f7ee35b6ea6d3dd009d8bea88a
- SHA512 87fa4e90b1f37d9718baac9ab20074d1442be4fc5e82c1f92481ed868e573163e12dc9d975bb519e2b8154749a782e2ea69f59baf9c33e945bf477ab50d29349
- SSDEEP 6144:OIZd3LdKpO8l1JLJLK7Pn3Xc+Iz1OSqer5+nDBASqer5+n:DZd3xqOaef41Wer5+neer5+n
- TLSH T13C749E1E3A64E0F3CA724E34AC2496955337B863BE6056A739D4530E8D672F48F37B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-06_2a0391be5c3f07dad8a44fedc8dcdefb_amadey_cobalt-strike_elex_njrat_redline-stealer_remcos_r.exe
Resource
win10v2004-20260129-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-06_2a0391be5c3f07dad8a44fedc8dcdefb_amadey_cobalt-strike_elex_njrat_redline-stealer_remcos_r.exe
Resource
win11-20260130-en
12 signatures
150 seconds
Malware Config
Extracted
Family
-
smokeloader
Botnet
-
lab
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://host-file-host6.com/
-
http://host-host-file8.com/
rc4.i32
rc4.i32
Targets
-
- Target 2026-04-06_2a0391be5c3f07dad8a44fedc8dcdefb_amadey_cobalt-strike_elex_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stop_tofsee
- Size 332KB
- SHA256 878d90f6c62720bec0171f8b560ec8af39015c1561e1ffc2a84bbc5e20294d6b
- MD5 2a0391be5c3f07dad8a44fedc8dcdefb
- SHA1 c34141ef5d2e87f7ee35b6ea6d3dd009d8bea88a
- SHA512 87fa4e90b1f37d9718baac9ab20074d1442be4fc5e82c1f92481ed868e573163e12dc9d975bb519e2b8154749a782e2ea69f59baf9c33e945bf477ab50d29349
- SSDEEP 6144:OIZd3LdKpO8l1JLJLK7Pn3Xc+Iz1OSqer5+nDBASqer5+n:DZd3xqOaef41Wer5+neer5+n
- TLSH T13C749E1E3A64E0F3CA724E34AC2496955337B863BE6056A739D4530E8D672F48F37B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Smokeloader family
-
Deletes itself
-
Suspicious use of SetThreadContext