General
- Target 2026-04-08_ff73724fc843a9e4d1dd52bfe445c72b_amadey_cobalt-strike_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc
- Size 452KB
- Sample260408-e724sag13p
- SHA256 185b3209d62df291d9c2fba52639c07a041ab30ad82e8deb914551eb273b6832
- MD5 ff73724fc843a9e4d1dd52bfe445c72b
- SHA1 7b725d11e038af93eff106b7b81428bf06b135cb
- SHA512 444c3d3fa8fd82977b7138cc16c8d9a2cc278013c41f77c02c9c67ae4749100e0e76860b3185be016142636154a79d89c2304335ff37344219ef1800e596da59
- SSDEEP 6144:J8Nu+JynZFsN3My0zhRx94mrgIu1evacEbWSqer5+nY:SNu+JSZFsN3Ehd4mkIu11Ser5+n
- TLSH T147A43A073665F4E2D6328771AC29C6F9673BB8E0FE5167962944632F4C72398CE53B20
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-08_ff73724fc843a9e4d1dd52bfe445c72b_amadey_cobalt-strike_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc.exe
Resource
win10v2004-20260130-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-08_ff73724fc843a9e4d1dd52bfe445c72b_amadey_cobalt-strike_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc.exe
Resource
win11-20260130-en
11 signatures
150 seconds
Malware Config
Extracted
Family
-
smokeloader
Botnet
-
pub4
Extracted
Family
-
smokeloader
Version
-
2022
C2
-
http://aapu.at/tmp/
-
http://poudineh.com/tmp/
-
http://firsttrusteedrx.ru/tmp/
-
http://kingpirate.ru/tmp/
rc4.i32
rc4.i32
Targets
-
- Target 2026-04-08_ff73724fc843a9e4d1dd52bfe445c72b_amadey_cobalt-strike_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc
- Size 452KB
- SHA256 185b3209d62df291d9c2fba52639c07a041ab30ad82e8deb914551eb273b6832
- MD5 ff73724fc843a9e4d1dd52bfe445c72b
- SHA1 7b725d11e038af93eff106b7b81428bf06b135cb
- SHA512 444c3d3fa8fd82977b7138cc16c8d9a2cc278013c41f77c02c9c67ae4749100e0e76860b3185be016142636154a79d89c2304335ff37344219ef1800e596da59
- SSDEEP 6144:J8Nu+JynZFsN3My0zhRx94mrgIu1evacEbWSqer5+nY:SNu+JSZFsN3Ehd4mkIu11Ser5+n
- TLSH T147A43A073665F4E2D6328771AC29C6F9673BB8E0FE5167962944632F4C72398CE53B20
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Smokeloader family
-
Deletes itself