2026-04-08_ff73724fc843a9e4d1dd52bfe445c72b_amadey_cobalt-strike_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-08_ff73724fc843a9e4d1dd52bfe445c72b_amadey_cobalt-strike_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc
Size 452KB
Sample260408-e724sag13p
SHA256 185b3209d62df291d9c2fba52639c07a041ab30ad82e8deb914551eb273b6832
MD5 ff73724fc843a9e4d1dd52bfe445c72b
SHA1 7b725d11e038af93eff106b7b81428bf06b135cb
SHA512 444c3d3fa8fd82977b7138cc16c8d9a2cc278013c41f77c02c9c67ae4749100e0e76860b3185be016142636154a79d89c2304335ff37344219ef1800e596da59
SSDEEP 6144:J8Nu+JynZFsN3My0zhRx94mrgIu1evacEbWSqer5+nY:SNu+JSZFsN3Ehd4mkIu11Ser5+n
TLSH
T147A43A073665F4E2D6328771AC29C6F9673BB8E0FE5167962944632F4C72398CE53B20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-08_ff73724fc843a9e4d1dd52bfe445c72b_amadey_cobalt-strike_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc

File Explorer

2026-04-08_ff73724fc843a9e4d1dd52bfe445c72b_amadey_cobalt-strike_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc

.exe 452KB

2026-04-08_ff73724fc843a9e4d1dd52bfe445c72b_amadey_cobalt-strike_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc

IMPHASH 30d15c7b3cce8f8931262599cc59559f
SHA256 185b3209d62df291d9c2fba52639c07a041ab30ad82e8deb914551eb273b6832
MD5 ff73724fc843a9e4d1dd52bfe445c72b
SHA1 7b725d11e038af93eff106b7b81428bf06b135cb
SHA512 444c3d3fa8fd82977b7138cc16c8d9a2cc278013c41f77c02c9c67ae4749100e0e76860b3185be016142636154a79d89c2304335ff37344219ef1800e596da59
SSDEEP 6144:J8Nu+JynZFsN3My0zhRx94mrgIu1evacEbWSqer5+nY:SNu+JSZFsN3Ehd4mkIu11Ser5+n
TLSH
T147A43A073665F4E2D6328771AC29C6F9673BB8E0FE5167962944632F4C72398CE53B20
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17852

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateMutexW CopyFileExW GetStringTypeA _llseek LocalCompact EnumCalendarInfoW VerSetConditionMask GetCurrentActCtx SetDefaultCommConfigW WaitForSingleObject WriteConsoleInputA SetEvent GetModuleHandleW EnumTimeFormatsW InitializeCriticalSection GlobalAlloc GetFirmwareEnvironmentVariableA LoadLibraryW GetFileAttributesA GetConsoleAliasW WritePrivateProfileSectionW TerminateProcess lstrcmpW GlobalUnlock SetCurrentDirectoryA GetCPInfoExW OpenMutexW IsDBCSLeadByteEx SetLastError GetProcAddress PeekConsoleInputW SearchPathA OpenWaitableTimerW LocalAlloc BuildCommDCBAndTimeoutsW FindFirstVolumeMountPointW AddAtomW GlobalGetAtomNameW AddAtomA EnumResourceTypesW GetPrivateProfileSectionNamesA FindNextFileA FreeEnvironmentStringsW FindNextFileW SetCalendarInfoA GetWindowsDirectoryW DeleteFileW GetCurrentProcessId EnumCalendarInfoExA SetStdHandle WriteConsoleW GetLastError MoveFileA HeapAlloc DeleteFileA GetCommandLineA HeapSetInformation GetStartupInfoW EncodePointer DecodePointer IsProcessorFeaturePresent ExitProcess WriteFile GetStdHandle GetModuleFileNameW HeapCreate HeapDestroy GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId GetCurrentThread UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentProcess EnterCriticalSection LeaveCriticalSection GetModuleFileNameA WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime RaiseException FatalAppExitA SetConsoleCtrlHandler FreeLibrary InterlockedExchange GetLocaleInfoW LCMapStringW MultiByteToWideChar GetStringTypeW HeapFree Sleep GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale RtlUnwind HeapSize HeapReAlloc GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer CloseHandle CreateFileW

user32

LoadMenuW

Name

.text

Size

111KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

76KB

Virtual Size

39.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

88KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

xIZaeanh

Size

19KB

Virtual Size

19KB

Characteristics

Name

NgNYXDAn

Size

3KB

Virtual Size

2KB

Characteristics

Name

VzfjzCfD

Size

30KB

Virtual Size

29KB

Characteristics

Name

lGFfLdKw

Size

1024B

Virtual Size

943B

Characteristics

Name

zfVvcAUE

Size

15KB

Virtual Size

15KB

Characteristics

Name

HWbHGWuh

Size

2KB

Virtual Size

1KB

Characteristics

Name

jhkKfihQ

Size

8KB

Virtual Size

7KB

Characteristics

Name

sKZVZXOu

Size

3KB

Virtual Size

2KB

Characteristics

Name

idUMofIW

Size

25KB

Virtual Size

24KB

Characteristics

Name

NsJqlLgy

Size

1KB

Virtual Size

1KB

Characteristics

Name

ladNYKez

Size

61KB

Virtual Size

61KB

Characteristics

Name

KUZwrhVI

Size

4KB

Virtual Size

4KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-08_ff73724fc843a9e4d1dd52bfe445c72b_amadey_cobalt-strike_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc

kernel32

user32

generic