2026-04-09_6f9a79fa19b7f2dd65efe02460d41c08_amadey_cobalt-strike_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

General

Target
2026-04-09_6f9a79fa19b7f2dd65efe02460d41c08_amadey_cobalt-strike_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
Size 417KB
Sample260409-rx47lsbx2k
SHA256 b770d3b9ae7ccb0686d97fb35f8880ed469d47ad5fedc538a1b0c705330074c6
MD5 6f9a79fa19b7f2dd65efe02460d41c08
SHA1 8022db789f6250be3dac4a9b452b82ccc630a2de
SHA512 963441c8639b4d3608d70e598fd7e17d9e3b9c46c85833322123b3b086571b1aad97dd121153d792be068c525e46dad0eeacce6179b04ce1d04f88e6d92fca7e
SSDEEP 6144:Ez3LMfSLeyvGxppnPs/FD5Ddp3tTtSqer5+nPfSqer5+nZ:63of6bexDkhHp3Z9er5+nrer5+n
TLSH
T182946C0B76A5BCD2DA724F309C29C6E4672BB8529E5527772598630F0C732B4CE63B34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-09_6f9a79fa19b7f2dd65efe02460d41c08_amadey_cobalt-strike_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-04-09_6f9a79fa19b7f2dd65efe02460d41c08_amadey_cobalt-strike_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

.exe 417KB

2026-04-09_6f9a79fa19b7f2dd65efe02460d41c08_amadey_cobalt-strike_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 107d60072c769400e724c334a5b4d7d3
SHA256 b770d3b9ae7ccb0686d97fb35f8880ed469d47ad5fedc538a1b0c705330074c6
MD5 6f9a79fa19b7f2dd65efe02460d41c08
SHA1 8022db789f6250be3dac4a9b452b82ccc630a2de
SHA512 963441c8639b4d3608d70e598fd7e17d9e3b9c46c85833322123b3b086571b1aad97dd121153d792be068c525e46dad0eeacce6179b04ce1d04f88e6d92fca7e
SSDEEP 6144:Ez3LMfSLeyvGxppnPs/FD5Ddp3tTtSqer5+nPfSqer5+nZ:63of6bexDkhHp3Z9er5+nrer5+n
TLSH
T182946C0B76A5BCD2DA724F309C29C6E4672BB8529E5527772598630F0C732B4CE63B34
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

21918

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ruwevijumi layuril\tufinusexod.pdb

kernel32

OpenJobObjectA GetCommConfig GetDateFormatA GetEnvironmentStrings GlobalAlloc LoadLibraryW CreateEventA GetConsoleAliasExesLengthW GetStringTypeExW lstrcpynW EnumSystemCodePagesA GetFileAttributesW VerifyVersionInfoA LocalReAlloc GetBinaryTypeA MultiByteToWideChar GetConsoleAliasesW SetLastError GetProcAddress VirtualAlloc CallNamedPipeA SetTimerQueueTimer WriteConsoleA InterlockedExchangeAdd GetFileType CreateHardLinkW WriteProfileSectionW FindNextChangeNotification FindAtomA FoldStringA FreeEnvironmentStringsW GetStringTypeW EnumDateFormatsW GetWindowsDirectoryW GlobalAddAtomW OpenFileMappingA LCMapStringW FindResourceExW GetModuleHandleW Sleep ExitProcess GetStartupInfoW HeapAlloc GetLastError HeapFree TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement HeapSize WriteFile GetStdHandle GetModuleFileNameA DeleteCriticalSection LeaveCriticalSection EnterCriticalSection TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent LoadLibraryA InitializeCriticalSectionAndSpinCount GetModuleFileNameW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapReAlloc RaiseException GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind GetLocaleInfoA WideCharToMultiByte GetModuleHandleA LCMapStringA GetStringTypeA

user32

ValidateRect GetMenuInfo

gdi32

GetGlyphIndicesA CreateDCA

Name

.text

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

139KB

Virtual Size

655KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

75KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

lJxdzSjg

Size

56KB

Virtual Size

56KB

Characteristics

Name

qbCNATSi

Size

4KB

Virtual Size

3KB

Characteristics

Name

lKhcfWjO

Size

69KB

Virtual Size

69KB

Characteristics

Name

VyVfdhhq

Size

4KB

Virtual Size

4KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-09_6f9a79fa19b7f2dd65efe02460d41c08_amadey_cobalt-strike_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

kernel32

user32

gdi32

generic