General
- Target 2026-04-07_abf2ee02328887d24a7cb22413c61ad9_amadey_cobalt-strike_elex_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stop_tofsee
- Size 350KB
- Sample260407-spkzfaax41
- SHA256 d3f556a208aaaebf09db332e95255acfd7206114c04b73a29adf4c049337ca72
- MD5 abf2ee02328887d24a7cb22413c61ad9
- SHA1 51331abe22dc491935fbf6f257ee87a9853a4a1c
- SHA512 a8ad573204f193c19564f6e122ca16114076b7371502f086805631e6fe382d366704ef539934bb53d7cf148c6ba4607a3aac716c501ec554d1f5f2c393b3f197
- SSDEEP 6144:6gq5XLwTNe6p+wz/W5Vu2tSqer5+nDFouSOHvnzSvOJFILd2P:6gcONeRwi5Uwer5+nZo3dvOJFIgP
- TLSH T1CD748D157B10B4F3CB29AF70585DEA476320B8673711E89B28C4128A4EDF2D89F16F36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-07_abf2ee02328887d24a7cb22413c61ad9_amadey_cobalt-strike_elex_njrat_redline-stealer_remcos_r.exe
Resource
win10v2004-20260130-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-07_abf2ee02328887d24a7cb22413c61ad9_amadey_cobalt-strike_elex_njrat_redline-stealer_remcos_r.exe
Resource
win11-20260130-en
13 signatures
150 seconds
Malware Config
Extracted
Family
-
smokeloader
Botnet
-
lab
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://host-file-host6.com/
-
http://host-host-file8.com/
rc4.i32
rc4.i32
Targets
-
- Target 2026-04-07_abf2ee02328887d24a7cb22413c61ad9_amadey_cobalt-strike_elex_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stop_tofsee
- Size 350KB
- SHA256 d3f556a208aaaebf09db332e95255acfd7206114c04b73a29adf4c049337ca72
- MD5 abf2ee02328887d24a7cb22413c61ad9
- SHA1 51331abe22dc491935fbf6f257ee87a9853a4a1c
- SHA512 a8ad573204f193c19564f6e122ca16114076b7371502f086805631e6fe382d366704ef539934bb53d7cf148c6ba4607a3aac716c501ec554d1f5f2c393b3f197
- SSDEEP 6144:6gq5XLwTNe6p+wz/W5Vu2tSqer5+nDFouSOHvnzSvOJFILd2P:6gcONeRwi5Uwer5+nZo3dvOJFIgP
- TLSH T1CD748D157B10B4F3CB29AF70585DEA476320B8673711E89B28C4128A4EDF2D89F16F36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Smokeloader family
-
Deletes itself
-
Suspicious use of SetThreadContext