2026-04-06_514eaf43b555fa648ed36353fbec2cbf_amadey_cobalt-strike_elex_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-06_514eaf43b555fa648ed36353fbec2cbf_amadey_cobalt-strike_elex_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee
Size 507KB
Sample260406-vq136agy2p
SHA256 15b5a689b11694bc7ae8059a14776d90217cee667cc092c349a41bdbbf6f2ba8
MD5 514eaf43b555fa648ed36353fbec2cbf
SHA1 3c5267cf6a25196fc1be8c7281e064d50b5ad44b
SHA512 dc0b23beef3df86ba7f4037eb8650617b02ee7b84a544711b4d997a044a32214e2d3e9a6c2518af76c592f74eb46b7a113916ace119bb7f3d55060725403ba43
SSDEEP 6144:rugKLL0v9fBNo/2oLOjzdnfKVvSqer5+nYCSqer5+nDFoy:rugKH0v9f95KBer5+n9er5+nZoy
TLSH
T1C5B41A0B66A17CD6E9324F329D2DC5D4732EB4B2AE452B663194931F0C762B5CE23F60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-06_514eaf43b555fa648ed36353fbec2cbf_amadey_cobalt-strike_elex_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee

File Explorer

2026-04-06_514eaf43b555fa648ed36353fbec2cbf_amadey_cobalt-strike_elex_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee

.exe 507KB

2026-04-06_514eaf43b555fa648ed36353fbec2cbf_amadey_cobalt-strike_elex_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee

IMPHASH 8b512f0a0b2cd54ff600ee8ace8b2bd0
SHA256 15b5a689b11694bc7ae8059a14776d90217cee667cc092c349a41bdbbf6f2ba8
MD5 514eaf43b555fa648ed36353fbec2cbf
SHA1 3c5267cf6a25196fc1be8c7281e064d50b5ad44b
SHA512 dc0b23beef3df86ba7f4037eb8650617b02ee7b84a544711b4d997a044a32214e2d3e9a6c2518af76c592f74eb46b7a113916ace119bb7f3d55060725403ba43
SSDEEP 6144:rugKLL0v9fBNo/2oLOjzdnfKVvSqer5+nYCSqer5+nDFoy:rugKH0v9f95KBer5+n9er5+nZoy
TLSH
T1C5B41A0B66A17CD6E9324F329D2DC5D4732EB4B2AE452B663194931F0C762B5CE23F60
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20616

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetDefaultCommConfigW CreateHardLinkA GetConsoleAliasesA LoadLibraryW _hread IsBadCodePtr CreateEventA FormatMessageW GetStringTypeExW GetExitCodeProcess GetFileAttributesW WriteConsoleW WritePrivateProfileSectionW GetLogicalDriveStringsA ChangeTimerQueueTimer SetLastError GetProcAddress GlobalAddAtomA EnumSystemCodePagesW LocalAlloc FoldStringA FreeEnvironmentStringsW VirtualProtect GetWindowsDirectoryW GetFileInformationByHandle GlobalReAlloc InterlockedPushEntrySList LCMapStringW CloseHandle CreateFileA HeapSize lstrcpynA CallNamedPipeA VirtualAlloc GetVolumeNameForVolumeMountPointA GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc GetLastError HeapFree EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleHandleW Sleep ExitProcess WriteFile GetModuleFileNameA GetModuleFileNameW GetEnvironmentStringsW GetCommandLineW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage HeapReAlloc InitializeCriticalSectionAndSpinCount RtlUnwind MultiByteToWideChar LoadLibraryA SetStdHandle WriteConsoleA GetConsoleOutputCP LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA FlushFileBuffers RaiseException

user32

ClientToScreen LoadMenuA InvalidateRgn GetMenuInfo MessageBoxIndirectW CountClipboardFormats SetScrollInfo

gdi32

GetGlyphIndicesW

advapi32

RegOpenKeyA

Name

.text

Size

145KB

Virtual Size

144KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

38.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

104KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

RjdzOaYO

Size

4KB

Virtual Size

4KB

Characteristics

Name

PfIXqTGe

Size

512B

Virtual Size

248B

Characteristics

Name

gDbdPrSj

Size

2KB

Virtual Size

2KB

Characteristics

Name

EBlVmJHM

Size

4KB

Virtual Size

3KB

Characteristics

Name

ABXwdXju

Size

5KB

Virtual Size

4KB

Characteristics

Name

ZforVcIk

Size

512B

Virtual Size

241B

Characteristics

Name

ndBxCAOt

Size

6KB

Virtual Size

5KB

Characteristics

Name

tByHTXdQ

Size

2KB

Virtual Size

1KB

Characteristics

Name

PADLXKAV

Size

69KB

Virtual Size

69KB

Characteristics

Name

AIkVeHNs

Size

3KB

Virtual Size

2KB

Characteristics

Name

mZNvrztV

Size

115KB

Virtual Size

115KB

Characteristics

Name

tThpdXnc

Size

2KB

Virtual Size

1KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-06_514eaf43b555fa648ed36353fbec2cbf_amadey_cobalt-strike_elex_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee

kernel32

user32

gdi32

advapi32

generic