2026-04-09_673fc1541609a631344d8bba6792a7af_amadey_cobalt-strike_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-09_673fc1541609a631344d8bba6792a7af_amadey_cobalt-strike_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc
Size 753KB
Sample260409-vbqnwagy51
SHA256 1d238d014ee9bc305817e260ab7454aaa28ece80e77db5f116590851020d24b7
MD5 673fc1541609a631344d8bba6792a7af
SHA1 f6a25e10c504897d2df4d15ab00e2bc3537030dd
SHA512 cec5096a47948853987bc014d2686f51b32182ac53506c97c2818b9386d9412783e1d83c9421b8b493b71ab40ea59ce986f5a000ce52ededa747825281e0ec91
SSDEEP 6144:eRkkgNO7XthP3k0U7L4IFchOMScqer5+nBYFo89/drLHgDel:eR3n9hPeL1Jer5+nnA1
TLSH
T119F42753E791AAD9D61D45365F198184A32EF521AA0F6361391C130ECFA338BCF66E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-09_673fc1541609a631344d8bba6792a7af_amadey_cobalt-strike_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc

File Explorer

2026-04-09_673fc1541609a631344d8bba6792a7af_amadey_cobalt-strike_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc

.exe 753KB

2026-04-09_673fc1541609a631344d8bba6792a7af_amadey_cobalt-strike_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc

IMPHASH 23e8af559124378932e77f64e85571f5
SHA256 1d238d014ee9bc305817e260ab7454aaa28ece80e77db5f116590851020d24b7
MD5 673fc1541609a631344d8bba6792a7af
SHA1 f6a25e10c504897d2df4d15ab00e2bc3537030dd
SHA512 cec5096a47948853987bc014d2686f51b32182ac53506c97c2818b9386d9412783e1d83c9421b8b493b71ab40ea59ce986f5a000ce52ededa747825281e0ec91
SSDEEP 6144:eRkkgNO7XthP3k0U7L4IFchOMScqer5+nBYFo89/drLHgDel:eR3n9hPeL1Jer5+nnA1
TLSH
T119F42753E791AAD9D61D45365F198184A32EF521AA0F6361391C130ECFA338BCF66E3C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12341

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

PulseEvent lstrcmpA FindFirstFileW CopyFileExW _llseek EnumCalendarInfoW GetConsoleAliasA SetDefaultCommConfigW GlobalLock InterlockedCompareExchange SleepEx GetModuleHandleW GetWindowsDirectoryA EnumTimeFormatsW WriteFileGather EnumResourceTypesA GlobalAlloc GetSystemDirectoryW AddRefActCtx LoadLibraryW CopyFileW LeaveCriticalSection GetFileAttributesW WritePrivateProfileSectionW RaiseException GetCPInfoExW SetLastError GetProcAddress GetFirmwareEnvironmentVariableW OpenWaitableTimerW SetCalendarInfoW FindFirstVolumeMountPointW GetExitCodeThread AddAtomW CreateEventW FindNextFileW GetShortPathNameW ReadConsoleInputW LocalSize EnumCalendarInfoExA LocalFree HeapAlloc GetLastError DeleteFileA GetCommandLineA HeapSetInformation GetStartupInfoW ExitProcess DecodePointer WriteFile GetStdHandle GetModuleFileNameW HeapCreate EncodePointer EnterCriticalSection SetFilePointer SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime Sleep HeapFree SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize HeapReAlloc WriteConsoleW MultiByteToWideChar IsProcessorFeaturePresent LCMapStringW GetStringTypeW CloseHandle CreateFileW

user32

LoadMenuW

Name

.text

Size

44KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

76KB

Virtual Size

577KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

65KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

hLpQfiKE

Size

38KB

Virtual Size

38KB

Characteristics

Name

MYStIsKw

Size

3KB

Virtual Size

3KB

Characteristics

Name

rMFUjmKs

Size

2KB

Virtual Size

1KB

Characteristics

Name

BPKIdxGg

Size

129KB

Virtual Size

129KB

Characteristics

Name

LuaqmYqs

Size

313KB

Virtual Size

312KB

Characteristics

Name

MaBIKYZd

Size

33KB

Virtual Size

33KB

Characteristics

Name

mEmBSVsf

Size

1024B

Virtual Size

831B

Characteristics

Name

uiWcNNaS

Size

30KB

Virtual Size

29KB

Characteristics

Name

ioxAAtwZ

Size

2KB

Virtual Size

1KB

Characteristics

Name

glcddzqO

Size

14KB

Virtual Size

13KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-09_673fc1541609a631344d8bba6792a7af_amadey_cobalt-strike_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc

kernel32

user32

generic