2026-04-08_04346e6b86056dc8a831e5654cd06295_amadey_cobalt-strike_elex_redline-stealer_remcos_rhadamanthys_smoke-loader_stop_tofsee

General

Target
2026-04-08_04346e6b86056dc8a831e5654cd06295_amadey_cobalt-strike_elex_redline-stealer_remcos_rhadamanthys_smoke-loader_stop_tofsee
Size 248KB
Sample260408-2e8gesfv3s
SHA256 baa9eda6dc79c54e1421a8af999c6db90963235e887698f5709ae2fd6c4dbfa6
MD5 04346e6b86056dc8a831e5654cd06295
SHA1 9b88d8786754c766290e2f42894aef22f007a894
SHA512 1a0d4cace8e357f8fc376a2829bb8a1d5b70f22df3ea81c31c56fb353a94ec186011ba463de0b3c806aac2481120fe36587fa2efe6183b56c6444698c7f89cc2
SSDEEP 6144:NIZd3LdKpO8l1JLJLK7Pn3Xc+Iz1OSqer5+nf:qZd3xqOaef41Wer5+n
TLSH
T16C44DF2B3A64F3F3C6325634AC34D6D593FAB831AA6056937AD0134E8E232D45F27725
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-08_04346e6b86056dc8a831e5654cd06295_amadey_cobalt-strike_elex_redline-stealer_remcos_rhadamanthys_smoke-loader_stop_tofsee

File Explorer

2026-04-08_04346e6b86056dc8a831e5654cd06295_amadey_cobalt-strike_elex_redline-stealer_remcos_rhadamanthys_smoke-loader_stop_tofsee

.exe 248KB

2026-04-08_04346e6b86056dc8a831e5654cd06295_amadey_cobalt-strike_elex_redline-stealer_remcos_rhadamanthys_smoke-loader_stop_tofsee

IMPHASH be7581a01c1ad2f53e81adb31665eb55
SHA256 baa9eda6dc79c54e1421a8af999c6db90963235e887698f5709ae2fd6c4dbfa6
MD5 04346e6b86056dc8a831e5654cd06295
SHA1 9b88d8786754c766290e2f42894aef22f007a894
SHA512 1a0d4cace8e357f8fc376a2829bb8a1d5b70f22df3ea81c31c56fb353a94ec186011ba463de0b3c806aac2481120fe36587fa2efe6183b56c6444698c7f89cc2
SSDEEP 6144:NIZd3LdKpO8l1JLJLK7Pn3Xc+Iz1OSqer5+nf:qZd3xqOaef41Wer5+n
TLSH
T16C44DF2B3A64F3F3C6325634AC34D6D593FAB831AA6056937AD0134E8E232D45F27725
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

30448

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA CreateSemaphoreW RequestWakeupLatency AddAtomA CreateFileA FindActCtxSectionStringA WriteConsoleInputW GetSystemWindowsDirectoryA WriteFile FindFirstVolumeMountPointW CreateDirectoryExW GlobalSize GetLogicalDriveStringsW ReadConsoleInputW GetComputerNameExA FreeUserPhysicalPages GetCurrentDirectoryA ContinueDebugEvent LCMapStringA GetProcAddress GlobalAlloc GetCommandLineW GetBinaryTypeW InterlockedExchange ReadConsoleOutputCharacterW CreateMutexW GetConsoleTitleA SearchPathA FindResourceW FormatMessageW GetModuleHandleA EndUpdateResourceW GetLastError SetCommMask LocalReAlloc GetConsoleAliasA TerminateThread GlobalFlags GetConsoleAliasesLengthA GetVolumePathNameA SetVolumeMountPointW HeapAlloc GetLocaleInfoA GetComputerNameW SetConsoleWindowInfo DosDateTimeToFileTime EnumResourceLanguagesW LoadModule _hwrite QueryDosDeviceW CreateActCtxA DeleteVolumeMountPointA MoveFileWithProgressW AddRefActCtx WritePrivateProfileStringA GetUserDefaultLangID QueryMemoryResourceNotification WaitForSingleObject GetLongPathNameW InterlockedCompareExchange EnumTimeFormatsW VerifyVersionInfoW FindNextFileW GetConsoleAliasW SetLastError TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException RtlUnwind HeapFree MoveFileA GetStartupInfoW GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement GetCPInfo GetACP GetOEMCP IsValidCodePage HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc Sleep ExitProcess GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapSize WideCharToMultiByte MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer CloseHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle DeleteFileA

user32

GetMenuBarInfo

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-08_04346e6b86056dc8a831e5654cd06295_amadey_cobalt-strike_elex_redline-stealer_remcos_rhadamanthys_smoke-loader_stop_tofsee

kernel32

user32

generic