General
- Target 2026-04-07_c7b5c977716fc92b78adc95f0cc1b4d7_amadey_cobalt-strike_elex_icedid_njrat_rhadamanthys_smoke-loader_stealc
- Size 349KB
- Sample260407-epw5taas2s
- SHA256 aa89508cc2025c60ef10c64fcf4dce9ba2b0d096a5f4ae49b5c6c8667f2bf459
- MD5 c7b5c977716fc92b78adc95f0cc1b4d7
- SHA1 696f01cc474ba3153c0f255e92b5c1e36057ca5e
- SHA512 c9f216f7fbac8b05330e4be32cf220f2fed71ca41219296c89963bfa546e020177cbf57ef233afe9b2a90eb5742e346f705d1165c7ba9068a660d036b9ab9b89
- SSDEEP 6144:C0zCGKfrGi0IxopWbCbcoY8joSqer5+nDFoy:pdKD0IxopW+bier5+nZoy
- TLSH T1A9747C0D77A5D8E7D9728E349C308691273778E76EA18A6B25D4031D4C7B2B48F2AF34
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-07_c7b5c977716fc92b78adc95f0cc1b4d7_amadey_cobalt-strike_elex_icedid_njrat_rhadamanthys_smoke-loader_stealc.exe
Resource
win10v2004-20260129-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-07_c7b5c977716fc92b78adc95f0cc1b4d7_amadey_cobalt-strike_elex_icedid_njrat_rhadamanthys_smoke-loader_stealc.exe
Resource
win11-20260130-en
11 signatures
150 seconds
Malware Config
Extracted
Family
-
smokeloader
Botnet
-
pub4
Extracted
Family
-
smokeloader
Version
-
2022
C2
-
http://taibi.at/tmp/
-
http://01stroy.ru/tmp/
-
http://mal-net.com/tmp/
-
http://gromograd.ru/tmp/
-
http://kingpirate.ru/tmp/
rc4.i32
rc4.i32
Targets
-
- Target 2026-04-07_c7b5c977716fc92b78adc95f0cc1b4d7_amadey_cobalt-strike_elex_icedid_njrat_rhadamanthys_smoke-loader_stealc
- Size 349KB
- SHA256 aa89508cc2025c60ef10c64fcf4dce9ba2b0d096a5f4ae49b5c6c8667f2bf459
- MD5 c7b5c977716fc92b78adc95f0cc1b4d7
- SHA1 696f01cc474ba3153c0f255e92b5c1e36057ca5e
- SHA512 c9f216f7fbac8b05330e4be32cf220f2fed71ca41219296c89963bfa546e020177cbf57ef233afe9b2a90eb5742e346f705d1165c7ba9068a660d036b9ab9b89
- SSDEEP 6144:C0zCGKfrGi0IxopWbCbcoY8joSqer5+nDFoy:pdKD0IxopW+bier5+nZoy
- TLSH T1A9747C0D77A5D8E7D9728E349C308691273778E76EA18A6B25D4031D4C7B2B48F2AF34
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Smokeloader family
-
Deletes itself