2026-04-09_7ae34382b8c45d4ebd22e78ee86e176f_amadey_cobalt-strike_elex_redline-stealer_rhadamanthys_smoke-loader_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-09_7ae34382b8c45d4ebd22e78ee86e176f_amadey_cobalt-strike_elex_redline-stealer_rhadamanthys_smoke-loader_stealc
Size 813KB
Sample260409-v3d46ag18l
SHA256 8e82780c60f513c3bddefba1dc021030abb11e7cbd3c5fead0bccb890f3dbedf
MD5 7ae34382b8c45d4ebd22e78ee86e176f
SHA1 97d5ab66eba084f8494afb5a6dfb2962ff88efb3
SHA512 8b00f787b01f03977c01d2d4b58e72d8324845959cd62d94998c6b29a8dfa9961e1636bd8356390a1173a82db6052a2478ac93e23367bf80e87fd29083ee96c9
SSDEEP 6144:MTANJC+3fD5AZgY26AH7vaVRXL4IFchOMScqer5+nBYz89/drLHgDe4ypq6qer5Q:+ANJCqfrrHunL1Jer5+nWA14Per5+n
TLSH
T19D053803F791A9D4D66A46769F2482A4632AF461AE0B6355394C131ECF63387CF62F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-09_7ae34382b8c45d4ebd22e78ee86e176f_amadey_cobalt-strike_elex_redline-stealer_rhadamanthys_smoke-loader_stealc

File Explorer

2026-04-09_7ae34382b8c45d4ebd22e78ee86e176f_amadey_cobalt-strike_elex_redline-stealer_rhadamanthys_smoke-loader_stealc

.exe 813KB

2026-04-09_7ae34382b8c45d4ebd22e78ee86e176f_amadey_cobalt-strike_elex_redline-stealer_rhadamanthys_smoke-loader_stealc

IMPHASH 30d15c7b3cce8f8931262599cc59559f
SHA256 8e82780c60f513c3bddefba1dc021030abb11e7cbd3c5fead0bccb890f3dbedf
MD5 7ae34382b8c45d4ebd22e78ee86e176f
SHA1 97d5ab66eba084f8494afb5a6dfb2962ff88efb3
SHA512 8b00f787b01f03977c01d2d4b58e72d8324845959cd62d94998c6b29a8dfa9961e1636bd8356390a1173a82db6052a2478ac93e23367bf80e87fd29083ee96c9
SSDEEP 6144:MTANJC+3fD5AZgY26AH7vaVRXL4IFchOMScqer5+nBYz89/drLHgDe4ypq6qer5Q:+ANJCqfrrHunL1Jer5+nWA14Per5+n
TLSH
T19D053803F791A9D4D66A46769F2482A4632AF461AE0B6355394C131ECF63387CF62F3C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17852

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateMutexW CopyFileExW GetStringTypeA _llseek LocalCompact EnumCalendarInfoW VerSetConditionMask GetCurrentActCtx SetDefaultCommConfigW WaitForSingleObject WriteConsoleInputA SetEvent GetModuleHandleW EnumTimeFormatsW InitializeCriticalSection GlobalAlloc GetFirmwareEnvironmentVariableA LoadLibraryW GetFileAttributesA GetConsoleAliasW WritePrivateProfileSectionW TerminateProcess lstrcmpW GlobalUnlock SetCurrentDirectoryA GetCPInfoExW OpenMutexW IsDBCSLeadByteEx SetLastError GetProcAddress PeekConsoleInputW SearchPathA OpenWaitableTimerW LocalAlloc BuildCommDCBAndTimeoutsW FindFirstVolumeMountPointW AddAtomW GlobalGetAtomNameW AddAtomA EnumResourceTypesW GetPrivateProfileSectionNamesA FindNextFileA FreeEnvironmentStringsW FindNextFileW SetCalendarInfoA GetWindowsDirectoryW DeleteFileW GetCurrentProcessId EnumCalendarInfoExA SetStdHandle WriteConsoleW GetLastError MoveFileA HeapAlloc DeleteFileA GetCommandLineA HeapSetInformation GetStartupInfoW EncodePointer DecodePointer IsProcessorFeaturePresent ExitProcess WriteFile GetStdHandle GetModuleFileNameW HeapCreate HeapDestroy GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId GetCurrentThread UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentProcess EnterCriticalSection LeaveCriticalSection GetModuleFileNameA WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime RaiseException FatalAppExitA SetConsoleCtrlHandler FreeLibrary InterlockedExchange GetLocaleInfoW LCMapStringW MultiByteToWideChar GetStringTypeW HeapFree Sleep GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale RtlUnwind HeapSize HeapReAlloc GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer CloseHandle CreateFileW

user32

LoadMenuW

Name

.text

Size

111KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

76KB

Virtual Size

39.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

88KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

nllIiVmV

Size

38KB

Virtual Size

38KB

Characteristics

Name

AhWZyuqj

Size

1KB

Virtual Size

1KB

Characteristics

Name

ZoDEgRqr

Size

4KB

Virtual Size

3KB

Characteristics

Name

qAsITRaH

Size

96KB

Virtual Size

95KB

Characteristics

Name

TOejeuAK

Size

231KB

Virtual Size

231KB

Characteristics

Name

PxwgjepV

Size

54KB

Virtual Size

54KB

Characteristics

Name

LYtCLHEU

Size

2KB

Virtual Size

1KB

Characteristics

Name

vLojkEsX

Size

57KB

Virtual Size

57KB

Characteristics

Name

VetTkxBD

Size

512B

Virtual Size

203B

Characteristics

Name

cmfQMtfV

Size

50KB

Virtual Size

50KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-09_7ae34382b8c45d4ebd22e78ee86e176f_amadey_cobalt-strike_elex_redline-stealer_rhadamanthys_smoke-loader_stealc

kernel32

user32

generic