General
- Target 2026-04-08_0c5bb88d009b44dd9ad526a8e3d04dbe_amadey_cobalt-strike_elex_redline-stealer_rhadamanthys_smoke-loader_stealc
- Size 532KB
- Sample260408-eca2tahz2v
- SHA256 9ae8af4ded71b47b54a3c086f739e9b91ae840e5b2573ac38e74f861d35e4f02
- MD5 0c5bb88d009b44dd9ad526a8e3d04dbe
- SHA1 32fd01eb76986d3490b0ba52c63926020101fc23
- SHA512 2b0dff9e15b9188077273fa0b7e49db9924a2c90173698e26f6042f483eedc16cfb8aea13746ff32ea4e89c133d56d5c5685a69e785699782760bf718536a645
- SSDEEP 12288:4TWAx4ytkcPgxa3pier5+naer5+n7xvOJFIw4WR:41tzPggxvOJFIw4WR
- TLSH T1BFC45C027714B8E3C6259F705929D6FA6325B8A3BF04AA9A1844935F0CFB2D5DF13F24
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-08_0c5bb88d009b44dd9ad526a8e3d04dbe_amadey_cobalt-strike_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe
Resource
win10v2004-20260130-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-08_0c5bb88d009b44dd9ad526a8e3d04dbe_amadey_cobalt-strike_elex_redline-stealer_rhadamanthys_smoke-loader_stealc.exe
Resource
win11-20260130-en
11 signatures
150 seconds
Malware Config
Extracted
Family
-
smokeloader
Botnet
-
pub4
Extracted
Family
-
smokeloader
Version
-
2022
C2
-
http://aapu.at/tmp/
-
http://poudineh.com/tmp/
-
http://firsttrusteedrx.ru/tmp/
-
http://kingpirate.ru/tmp/
rc4.i32
rc4.i32
Targets
-
- Target 2026-04-08_0c5bb88d009b44dd9ad526a8e3d04dbe_amadey_cobalt-strike_elex_redline-stealer_rhadamanthys_smoke-loader_stealc
- Size 532KB
- SHA256 9ae8af4ded71b47b54a3c086f739e9b91ae840e5b2573ac38e74f861d35e4f02
- MD5 0c5bb88d009b44dd9ad526a8e3d04dbe
- SHA1 32fd01eb76986d3490b0ba52c63926020101fc23
- SHA512 2b0dff9e15b9188077273fa0b7e49db9924a2c90173698e26f6042f483eedc16cfb8aea13746ff32ea4e89c133d56d5c5685a69e785699782760bf718536a645
- SSDEEP 12288:4TWAx4ytkcPgxa3pier5+naer5+n7xvOJFIw4WR:41tzPggxvOJFIw4WR
- TLSH T1BFC45C027714B8E3C6259F705929D6FA6325B8A3BF04AA9A1844935F0CFB2D5DF13F24
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Smokeloader family
-
Deletes itself