2026-04-07_2a4f36eaf33c151868ca38fa4972f429_amadey_cobalt-strike_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

General

Target
2026-04-07_2a4f36eaf33c151868ca38fa4972f429_amadey_cobalt-strike_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 540KB
Sample260407-kma3fset61
SHA256 852e6f02cd5c5a07a2cdeea8325da799dbeb0a68ed58defe9da3fd8df65c2e88
MD5 2a4f36eaf33c151868ca38fa4972f429
SHA1 3ba9990eb59c33a07a32b5c8e52ad81b561c4eef
SHA512 2bfd5f9ac471251b0399e47665bd067ce032213e27b18f1ce802974ce91fffd1e48c7df4176f1d168890c974cf39e5cf2075e49da6fc50f30fe81786e5222027
SSDEEP 6144:Avy+KJXJoJ5+5djBmtecKHPJZZzLSqer5+nGTeRH51SvOJFIGR8lgmzbM:AvmJoJ5+DjbnHPJP/er5+nHQvOJFIRPM
TLSH
T131C45B02B30038F3C719ABB01A5EE7AA7315B4773F57B99A354C564B09EB1C5DB22B24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-07_2a4f36eaf33c151868ca38fa4972f429_amadey_cobalt-strike_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-04-07_2a4f36eaf33c151868ca38fa4972f429_amadey_cobalt-strike_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 540KB

2026-04-07_2a4f36eaf33c151868ca38fa4972f429_amadey_cobalt-strike_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH e3bc5655ddd6201d21d34164ffe2db78
SHA256 852e6f02cd5c5a07a2cdeea8325da799dbeb0a68ed58defe9da3fd8df65c2e88
MD5 2a4f36eaf33c151868ca38fa4972f429
SHA1 3ba9990eb59c33a07a32b5c8e52ad81b561c4eef
SHA512 2bfd5f9ac471251b0399e47665bd067ce032213e27b18f1ce802974ce91fffd1e48c7df4176f1d168890c974cf39e5cf2075e49da6fc50f30fe81786e5222027
SSDEEP 6144:Avy+KJXJoJ5+5djBmtecKHPJZZzLSqer5+nGTeRH51SvOJFIGR8lgmzbM:AvmJoJ5+DjbnHPJP/er5+nHQvOJFIRPM
TLSH
T131C45B02B30038F3C719ABB01A5EE7AA7315B4773F57B99A354C564B09EB1C5DB22B24
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

44140

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

PeekNamedPipe BuildCommDCBAndTimeoutsA UpdateResourceA InterlockedIncrement CreateJobObjectW GetNamedPipeHandleStateA GetProfileSectionA GetModuleHandleW LocalFlags GetNumberFormatA GetCommandLineA GlobalAlloc AddRefActCtx LoadLibraryW GetLocaleInfoW SetVolumeMountPointA ReadFile GetVolumePathNameA FindNextVolumeMountPointW InterlockedExchange DeleteFiber GetStartupInfoA FindFirstFileA GetCPInfoExW GetLastError GetCurrentDirectoryW SetLastError GetProcAddress HeapSize MoveFileW IsValidCodePage OpenWaitableTimerA WriteConsoleA GetNumberFormatW GetModuleHandleA FreeEnvironmentStringsW FindNextFileW GetCPInfoExA ReadConsoleInputW LocalSize GetVolumeNameForVolumeMountPointW CommConfigDialogW CreateFileW FlushFileBuffers WriteConsoleW WideCharToMultiByte InterlockedDecrement MultiByteToWideChar EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapFree DeleteFileA HeapSetInformation GetStartupInfoW GetCPInfo RaiseException RtlUnwind HeapAlloc LCMapStringW IsProcessorFeaturePresent GetACP GetOEMCP TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess HeapCreate ExitProcess WriteFile GetStdHandle GetModuleFileNameW GetModuleFileNameA GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale HeapReAlloc SetFilePointer GetConsoleCP GetConsoleMode SetStdHandle CloseHandle

user32

CharUpperA CharToOemBuffA

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-07_2a4f36eaf33c151868ca38fa4972f429_amadey_cobalt-strike_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

kernel32

user32

generic