2026-04-07_091a8ee0a557e807632d50c2813a2e7a_amadey_cobalt-strike_elex_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

General

Target
2026-04-07_091a8ee0a557e807632d50c2813a2e7a_amadey_cobalt-strike_elex_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 317KB
Sample260407-fdte8aaw2y
SHA256 4107864fb614b0f0a69f3331f352cc04fcbffee4fc3f95512f13c6925883b953
MD5 091a8ee0a557e807632d50c2813a2e7a
SHA1 94394ed1796fecef0030645ad50b31a1d627875f
SHA512 dd7966fdccfed0a0186b088610bf857302d01407786907dd9aa54142878f198959bf575e19d3258a9763678ef728b8f40160338eebfff00ff154ea0b98d94abf
SSDEEP 6144:NAPlNTz1nbJpEVBQqBhmTqSqer5+nDFoyU:aPb1NpEVy4Uier5+nZoy
TLSH
T1C8648E0D7A95C8E7D9228E34AC3082E06776B8D75F819A6B36D4131E5C7B2F48F25B34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-07_091a8ee0a557e807632d50c2813a2e7a_amadey_cobalt-strike_elex_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-04-07_091a8ee0a557e807632d50c2813a2e7a_amadey_cobalt-strike_elex_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 317KB

2026-04-07_091a8ee0a557e807632d50c2813a2e7a_amadey_cobalt-strike_elex_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH 1a21bc96f45cd14b947cc79f5712c961
SHA256 4107864fb614b0f0a69f3331f352cc04fcbffee4fc3f95512f13c6925883b953
MD5 091a8ee0a557e807632d50c2813a2e7a
SHA1 94394ed1796fecef0030645ad50b31a1d627875f
SHA512 dd7966fdccfed0a0186b088610bf857302d01407786907dd9aa54142878f198959bf575e19d3258a9763678ef728b8f40160338eebfff00ff154ea0b98d94abf
SSDEEP 6144:NAPlNTz1nbJpEVBQqBhmTqSqer5+nDFoyU:aPb1NpEVy4Uier5+nZoy
TLSH
T1C8648E0D7A95C8E7D9228E34AC3082E06776B8D75F819A6B36D4131E5C7B2F48F25B34
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

18974

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\dipiharine\gewuy\pulaveju-tuk fuxunawu kumigu.pdb

kernel32

WaitNamedPipeA SetFirmwareEnvironmentVariableA GetUserDefaultLCID InterlockedCompareExchange AddConsoleAliasW GetModuleHandleW EnumCalendarInfoExW ReadConsoleW SetCommState EnumResourceTypesA TlsSetValue FindResourceExA LoadLibraryW GetVersionExW DeleteVolumeMountPointW GetFileAttributesA SetConsoleMode GetConsoleAliasW HeapValidate SetConsoleCursorPosition GetMailslotInfo WritePrivateProfileStringW GetStringTypeExA CreateJobObjectA GetProfileIntA GetCPInfoExW InterlockedDecrement GetLastError InterlockedFlushSList GetProcAddress VirtualAlloc BackupWrite WriteProfileSectionA RemoveDirectoryA SetStdHandle LocalAlloc MoveFileA AddAtomW BeginUpdateResourceA FoldStringA GetModuleHandleA FreeEnvironmentStringsW VirtualProtect OpenEventW QueryPerformanceFrequency GetShortPathNameW GetVersionExA GetWindowsDirectoryW GetConsoleProcessList DebugBreak DeleteFileA GetCommState VerSetConditionMask UnhandledExceptionFilter SetUnhandledExceptionFilter HeapFree MultiByteToWideChar GetCommandLineA GetStartupInfoA Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA TerminateProcess GetCurrentProcess IsDebuggerPresent HeapAlloc HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc GetCPInfo InterlockedIncrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsFree SetLastError GetCurrentThreadId FreeEnvironmentStringsA GetEnvironmentStrings WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind RaiseException LoadLibraryA InitializeCriticalSectionAndSpinCount LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize

user32

CharLowerBuffW

gdi32

SelectPalette GetCharWidthI

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-07_091a8ee0a557e807632d50c2813a2e7a_amadey_cobalt-strike_elex_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

kernel32

user32

gdi32

generic