2026-04-09_04d6a30232617aa4ad952e3918eaf6ab_amadey_cobalt-strike_elex_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-09_04d6a30232617aa4ad952e3918eaf6ab_amadey_cobalt-strike_elex_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc
Size 531KB
Sample260409-feptesh19j
SHA256 45613bd1b1ab6d0121f9b2c56985c173804363bbb1ecd873f8a4f4b61b3bc936
MD5 04d6a30232617aa4ad952e3918eaf6ab
SHA1 af7dba392477395a8842e023460a861d8b84b0d3
SHA512 54eb086ceb12d8cb4c61057ef6417fe598199c06f0014254718539460075bf0758de1ddd2db6924fcc9083711bce8c053bf26db393d8056a55aaf37bcb05e53d
SSDEEP 12288:G3WPicTa++YN3Z8er5+nZoyzer5+nZoy:sITp5pQX
TLSH
T168C43B0E7AADA8E6D9334E349C3486D02726B8D37E515B6F15C4531E8C7A3B4CE26B34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-09_04d6a30232617aa4ad952e3918eaf6ab_amadey_cobalt-strike_elex_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc

File Explorer

2026-04-09_04d6a30232617aa4ad952e3918eaf6ab_amadey_cobalt-strike_elex_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc

.exe 531KB

2026-04-09_04d6a30232617aa4ad952e3918eaf6ab_amadey_cobalt-strike_elex_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc

IMPHASH 09829a76b54b4835c677dc6fac4ef621
SHA256 45613bd1b1ab6d0121f9b2c56985c173804363bbb1ecd873f8a4f4b61b3bc936
MD5 04d6a30232617aa4ad952e3918eaf6ab
SHA1 af7dba392477395a8842e023460a861d8b84b0d3
SHA512 54eb086ceb12d8cb4c61057ef6417fe598199c06f0014254718539460075bf0758de1ddd2db6924fcc9083711bce8c053bf26db393d8056a55aaf37bcb05e53d
SSDEEP 12288:G3WPicTa++YN3Z8er5+nZoyzer5+nZoy:sITp5pQX
TLSH
T168C43B0E7AADA8E6D9334E349C3486D02726B8D37E515B6F15C4531E8C7A3B4CE26B34
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16303

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrcmpA SetLocaleInfoA WritePrivateProfileStructA EnumDateFormatsExW BuildCommDCBAndTimeoutsA LocalCompact EnumCalendarInfoW VerSetConditionMask GetModuleHandleExW WaitForSingleObject WriteConsoleInputA CallNamedPipeW _lclose GetCurrentThread EnumResourceTypesA SetProcessPriorityBoost GetEnvironmentStrings GlobalAlloc GetSystemDirectoryW GetFirmwareEnvironmentVariableA LoadLibraryW GetFileAttributesA GetComputerNameExA TransactNamedPipe GetConsoleAliasW SetMessageWaitingIndicator IsDBCSLeadByte SetDefaultCommConfigA DeactivateActCtx GetStdHandle OpenMutexW SetLastError GetProcAddress SearchPathA ResetEvent OpenWaitableTimerA CreateFileMappingA SetConsoleOutputCP WriteProfileSectionW AddAtomA FindFirstVolumeMountPointA GetModuleHandleA ContinueDebugEvent CreateMutexA FindNextFileW GetStringTypeW FatalAppExitA SetCalendarInfoA GetWindowsDirectoryW DeleteFileW EnumCalendarInfoExA CopyFileExA IsValidLocale EnumSystemLocalesA CompareStringW GetPrivateProfileSectionNamesW GetCommandLineA HeapSetInformation GetStartupInfoW HeapAlloc EnterCriticalSection LeaveCriticalSection DecodePointer UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TerminateProcess GetCurrentProcess GetModuleHandleW ExitProcess WriteFile GetModuleFileNameW GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId GetLastError InterlockedDecrement HeapCreate HeapDestroy QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime Sleep HeapFree GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind SetConsoleCtrlHandler FreeLibrary InterlockedExchange GetLocaleInfoW HeapReAlloc GetConsoleCP GetConsoleMode FlushFileBuffers LCMapStringW MultiByteToWideChar SetFilePointer IsProcessorFeaturePresent HeapSize CloseHandle WriteConsoleW SetStdHandle CreateFileW GetUserDefaultLCID GetLocaleInfoA DeleteFileA

user32

LoadMenuA

advapi32

GetKernelObjectSecurity

Name

.text

Size

86KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

76KB

Virtual Size

39.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

62KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

ummKRoEk

Size

7KB

Virtual Size

6KB

Characteristics

Name

KTYLsxkz

Size

3KB

Virtual Size

2KB

Characteristics

Name

WHbRBmqD

Size

1KB

Virtual Size

1KB

Characteristics

Name

ZXxGnQmb

Size

3KB

Virtual Size

3KB

Characteristics

Name

CjGCaNSk

Size

25KB

Virtual Size

24KB

Characteristics

Name

okBHxiHD

Size

512B

Virtual Size

459B

Characteristics

Name

dCqgShKH

Size

4KB

Virtual Size

4KB

Characteristics

Name

IyveXMtp

Size

1KB

Virtual Size

1KB

Characteristics

Name

dCjuyPkN

Size

122KB

Virtual Size

121KB

Characteristics

Name

BgyqmHIq

Size

512B

Virtual Size

39B

Characteristics

Name

HePlvXqy

Size

132KB

Virtual Size

132KB

Characteristics

Name

gYZnWfRE

Size

2KB

Virtual Size

2KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-09_04d6a30232617aa4ad952e3918eaf6ab_amadey_cobalt-strike_elex_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc

kernel32

user32

advapi32

generic