2026-04-10_8e9049e6a4c49a6db3ce8bda04dc0cfe_amadey_cobalt-strike_elex_njrat_rhadamanthys_smoke-loader_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-10_8e9049e6a4c49a6db3ce8bda04dc0cfe_amadey_cobalt-strike_elex_njrat_rhadamanthys_smoke-loader_stealc_stop
Size 309KB
Sample260410-c4bfjsfv41
SHA256 242b037111336d74da46fc11acd13c426de06480ead6f14794b4722d1382a44c
MD5 8e9049e6a4c49a6db3ce8bda04dc0cfe
SHA1 240e7994afd6047ba5b8750022d52480895b36d6
SHA512 0ceb32e09e9b24678bd0f5b1a588197bf4750f303fb4e23d01f75ea2615bfd6903886304fdb1a39308c4b6a968f63e06dcdaf316059f13676190ebc3e7023507
SSDEEP 3072:RLov5jxk6KrY93aH1QVoIP71LJo35oCT5+a8w5cEXot4WBww3mkRqer5+nclo:RLos6q4HoFeESqer5+n
TLSH
T142644B1535A5DCE6F6B2BA74D830ED90163FF8E2B96041AA2940130E5CF23944E77B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-10_8e9049e6a4c49a6db3ce8bda04dc0cfe_amadey_cobalt-strike_elex_njrat_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-04-10_8e9049e6a4c49a6db3ce8bda04dc0cfe_amadey_cobalt-strike_elex_njrat_rhadamanthys_smoke-loader_stealc_stop

.exe 309KB

2026-04-10_8e9049e6a4c49a6db3ce8bda04dc0cfe_amadey_cobalt-strike_elex_njrat_rhadamanthys_smoke-loader_stealc_stop

IMPHASH e65a8357ca24d261f7849f444ec396fa
SHA256 242b037111336d74da46fc11acd13c426de06480ead6f14794b4722d1382a44c
MD5 8e9049e6a4c49a6db3ce8bda04dc0cfe
SHA1 240e7994afd6047ba5b8750022d52480895b36d6
SHA512 0ceb32e09e9b24678bd0f5b1a588197bf4750f303fb4e23d01f75ea2615bfd6903886304fdb1a39308c4b6a968f63e06dcdaf316059f13676190ebc3e7023507
SSDEEP 3072:RLov5jxk6KrY93aH1QVoIP71LJo35oCT5+a8w5cEXot4WBww3mkRqer5+nclo:RLos6q4HoFeESqer5+n
TLSH
T142644B1535A5DCE6F6B2BA74D830ED90163FF8E2B96041AA2940130E5CF23944E77B6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7280

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

DebugActiveProcess FillConsoleOutputCharacterA SearchPathW SetPriorityClass GetConsoleAliasesLengthW CopyFileExW GetNumaProcessorNode GetDefaultCommConfigW InterlockedIncrement QueryDosDeviceA GetEnvironmentStringsW CreateDirectoryW GetUserDefaultLCID GetComputerNameW SetCommBreak ConnectNamedPipe CallNamedPipeW FreeEnvironmentStringsA GetModuleHandleW GetTickCount GetConsoleAliasesA GetCommandLineA LoadLibraryW GetConsoleMode Sleep GetConsoleAliasExesLengthW WriteConsoleOutputA HeapDestroy GetFileAttributesW GetBinaryTypeA GetModuleFileNameW GetStartupInfoW SetConsoleTitleA InterlockedExchange GetLastError GetProcAddress SetStdHandle SearchPathA BuildCommDCBW OpenWaitableTimerW LocalAlloc BeginUpdateResourceA FoldStringW WaitForMultipleObjects GetModuleHandleA GetShortPathNameW SetCalendarInfoA FindAtomW GlobalReAlloc GetVolumeInformationW CreateFileA SetFilePointer WriteConsoleW HeapAlloc MultiByteToWideChar HeapReAlloc ExitProcess TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapFree VirtualFree VirtualAlloc HeapCreate WriteFile GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId InterlockedDecrement HeapSize GetCPInfo GetACP GetOEMCP IsValidCodePage LoadLibraryA InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind LCMapStringA WideCharToMultiByte LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA GetConsoleCP FlushFileBuffers WriteConsoleA GetConsoleOutputCP CloseHandle

user32

SetFocus GetUserObjectInformationA

Name

.text

Size

89KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

995KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

122KB

Virtual Size

121KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

diuonSVx

Size

12KB

Virtual Size

12KB

Characteristics

Name

XuRhwhHD

Size

512B

Virtual Size

497B

Characteristics

Name

pmToXMIF

Size

65KB

Virtual Size

65KB

Characteristics

Name

EzmFutBw

Size

2KB

Virtual Size

1KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-10_8e9049e6a4c49a6db3ce8bda04dc0cfe_amadey_cobalt-strike_elex_njrat_rhadamanthys_smoke-loader_stealc_stop

kernel32

user32

generic