General
- Target 2026-04-08_6054d126155189f51f2e5d336890cb9a_amadey_cobalt-strike_elex_luca-stealer_lynx_mespinoza_njrat_smoke-loader
- Size 767KB
- Sample260408-gka3wsbs4y
- SHA256 d20a94538962ac459deadd2c370295359bc2f1a6e68da2c9a528f171afa0d0f1
- MD5 6054d126155189f51f2e5d336890cb9a
- SHA1 1830d21ea5dd188dbcd655947c2b14c04b0d2ed9
- SHA512 0dff7747f9663ec3f2cf1ae23e20f05206173f131f24f696daac140cd24b7c28d388ed413d12621723dc33157e706645f2f04cdb366557b20e31e0d49183cf51
- SSDEEP 12288:jgv/glM5bRppJ52h22uc1IwQQewLpHOkAMRF5UotqJsp8tHEUK6Lh77uSmM0hPME:8nKKRppJ52h2Tc1IwQQewluq3qw8tsae
- TLSH T12FF4B01234C26037E65624730829F67529BEF9301B314EEB97D49B3DAB24BD15A3293F
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-08_6054d126155189f51f2e5d336890cb9a_amadey_cobalt-strike_elex_luca-stealer_lynx_mespinoza_njrat_smoke-loader.exe
Resource
win10v2004-20260130-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-08_6054d126155189f51f2e5d336890cb9a_amadey_cobalt-strike_elex_luca-stealer_lynx_mespinoza_njrat_smoke-loader.exe
Resource
win11-20260130-en
11 signatures
150 seconds
Malware Config
Extracted
Family
-
smokeloader
Botnet
-
pub3
Extracted
Family
-
smokeloader
Version
-
2022
C2
-
http://sunvi.org/tmp/index.php
-
http://zarya-amura.ru/tmp/index.php
-
http://akros.in.net/tmp/index.php
rc4.i32
rc4.i32
Targets
-
- Target 2026-04-08_6054d126155189f51f2e5d336890cb9a_amadey_cobalt-strike_elex_luca-stealer_lynx_mespinoza_njrat_smoke-loader
- Size 767KB
- SHA256 d20a94538962ac459deadd2c370295359bc2f1a6e68da2c9a528f171afa0d0f1
- MD5 6054d126155189f51f2e5d336890cb9a
- SHA1 1830d21ea5dd188dbcd655947c2b14c04b0d2ed9
- SHA512 0dff7747f9663ec3f2cf1ae23e20f05206173f131f24f696daac140cd24b7c28d388ed413d12621723dc33157e706645f2f04cdb366557b20e31e0d49183cf51
- SSDEEP 12288:jgv/glM5bRppJ52h22uc1IwQQewLpHOkAMRF5UotqJsp8tHEUK6Lh77uSmM0hPME:8nKKRppJ52h2Tc1IwQQewluq3qw8tsae
- TLSH T12FF4B01234C26037E65624730829F67529BEF9301B314EEB97D49B3DAB24BD15A3293F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Smokeloader family
-
Deletes itself