2026-04-07_abf2ee02328887d24a7cb22413c61ad9_amadey_cobalt-strike_elex_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stop_tofsee

General

Target
2026-04-07_abf2ee02328887d24a7cb22413c61ad9_amadey_cobalt-strike_elex_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stop_tofsee
Size 350KB
Sample260407-spkzfaax41
SHA256 d3f556a208aaaebf09db332e95255acfd7206114c04b73a29adf4c049337ca72
MD5 abf2ee02328887d24a7cb22413c61ad9
SHA1 51331abe22dc491935fbf6f257ee87a9853a4a1c
SHA512 a8ad573204f193c19564f6e122ca16114076b7371502f086805631e6fe382d366704ef539934bb53d7cf148c6ba4607a3aac716c501ec554d1f5f2c393b3f197
SSDEEP 6144:6gq5XLwTNe6p+wz/W5Vu2tSqer5+nDFouSOHvnzSvOJFILd2P:6gcONeRwi5Uwer5+nZo3dvOJFIgP
TLSH
T1CD748D157B10B4F3CB29AF70585DEA476320B8673711E89B28C4128A4EDF2D89F16F36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-07_abf2ee02328887d24a7cb22413c61ad9_amadey_cobalt-strike_elex_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stop_tofsee

File Explorer

2026-04-07_abf2ee02328887d24a7cb22413c61ad9_amadey_cobalt-strike_elex_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stop_tofsee

.exe 350KB

2026-04-07_abf2ee02328887d24a7cb22413c61ad9_amadey_cobalt-strike_elex_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stop_tofsee

IMPHASH 847f96cdadc895b3547edbb7a505a62a
SHA256 d3f556a208aaaebf09db332e95255acfd7206114c04b73a29adf4c049337ca72
MD5 abf2ee02328887d24a7cb22413c61ad9
SHA1 51331abe22dc491935fbf6f257ee87a9853a4a1c
SHA512 a8ad573204f193c19564f6e122ca16114076b7371502f086805631e6fe382d366704ef539934bb53d7cf148c6ba4607a3aac716c501ec554d1f5f2c393b3f197
SSDEEP 6144:6gq5XLwTNe6p+wz/W5Vu2tSqer5+nDFouSOHvnzSvOJFILd2P:6gcONeRwi5Uwer5+nZo3dvOJFIgP
TLSH
T1CD748D157B10B4F3CB29AF70585DEA476320B8673711E89B28C4128A4EDF2D89F16F36
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

30516

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\bagoxa\carobawob44-kiditowekopi\77-l.pdb

kernel32

LoadLibraryA CreateSemaphoreW RequestWakeupLatency AddAtomA CreateFileA FindActCtxSectionStringA WriteConsoleInputW LoadModule WriteFile FindFirstVolumeMountPointW CreateDirectoryExW GlobalSize WaitForMultipleObjectsEx ReadConsoleInputW GetCurrentProcess FreeUserPhysicalPages WriteConsoleOutputAttribute ContinueDebugEvent LCMapStringA GetProcAddress GlobalAlloc GetCommandLineW GetBinaryTypeW InterlockedExchange CreateMutexA GetConsoleTitleA SearchPathA FindResourceW FreeConsole GetModuleHandleA EndUpdateResourceW GetLastError SetCommMask LocalReAlloc GetComputerNameExA GetConsoleAliasA WritePrivateProfileSectionW GlobalFlags GetConsoleAliasesLengthA FindResourceA SetVolumeMountPointW HeapAlloc GetLocaleInfoA GetComputerNameW GetCurrentProcessId DosDateTimeToFileTime EnumResourceLanguagesW _hwrite CreateActCtxA DeleteVolumeMountPointA MoveFileWithProgressW AddRefActCtx WritePrivateProfileStringA GetUserDefaultLangID QueryMemoryResourceNotification WaitForSingleObject GetLongPathNameW InterlockedCompareExchange VerifyVersionInfoW EnumCalendarInfoW FindNextFileW EnumTimeFormatsW SetLastError TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException RtlUnwind HeapFree MoveFileA GetStartupInfoW GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement GetCPInfo GetACP GetOEMCP IsValidCodePage HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc Sleep ExitProcess GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime HeapSize WideCharToMultiByte MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer CloseHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle DeleteFileA

user32

GetMenuBarInfo

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-07_abf2ee02328887d24a7cb22413c61ad9_amadey_cobalt-strike_elex_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stop_tofsee

kernel32

user32

generic