2026-04-11_0e0c43843607e7406d77358321b48ef1_amadey_cobalt-strike_elex_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee

General

Target
2026-04-11_0e0c43843607e7406d77358321b48ef1_amadey_cobalt-strike_elex_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 325KB
Sample260411-ppb5raft8j
SHA256 7b03c8d0d726b4a3788ac6343d21c334bd8832d3ec830c4e1aefcd95476cb946
MD5 0e0c43843607e7406d77358321b48ef1
SHA1 c96959d6febc4551b0ecd8b3064d81e6805cc95c
SHA512 2e930255942666337d2bcdce43fa805227bdb47a91782b33c35c31905a828f2457c695ce177efb6125c3123625c9305b9519d896a1dec55a29fda8bfcf3a9b5a
SSDEEP 6144:UL9N3/RuQpSQkgjJaQL4SGPj5lSqer5+nFS:UT3/dFTGPjHer5+n
TLSH
T1FF644B2D3665E4E2CD728F3458F4C6A5D727BC636A70469B79D4334F4C332A88E26B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-11_0e0c43843607e7406d77358321b48ef1_amadey_cobalt-strike_elex_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-04-11_0e0c43843607e7406d77358321b48ef1_amadey_cobalt-strike_elex_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 325KB

2026-04-11_0e0c43843607e7406d77358321b48ef1_amadey_cobalt-strike_elex_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH 9335a172a86e7d70ffc527b2c13e9b22
SHA256 7b03c8d0d726b4a3788ac6343d21c334bd8832d3ec830c4e1aefcd95476cb946
MD5 0e0c43843607e7406d77358321b48ef1
SHA1 c96959d6febc4551b0ecd8b3064d81e6805cc95c
SHA512 2e930255942666337d2bcdce43fa805227bdb47a91782b33c35c31905a828f2457c695ce177efb6125c3123625c9305b9519d896a1dec55a29fda8bfcf3a9b5a
SSDEEP 6144:UL9N3/RuQpSQkgjJaQL4SGPj5lSqer5+nFS:UT3/dFTGPjHer5+n
TLSH
T1FF644B2D3665E4E2CD728F3458F4C6A5D727BC636A70469B79D4334F4C332A88E26B21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

5778

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFullPathNameW GlobalDeleteAtom OpenJobObjectA GetSystemWindowsDirectoryW GetCommProperties GetModuleHandleW GetTickCount GetCommandLineA GetSystemTimes GlobalAlloc SetFileShortNameW Sleep FormatMessageW DeleteVolumeMountPointW HeapCreate WriteConsoleW VirtualUnlock FlushInstructionCache GetShortPathNameA InterlockedExchange GetLogicalDriveStringsA GetProcAddress SearchPathA GetNumaHighestNodeNumber OpenWaitableTimerA GetAtomNameA LoadLibraryA SetCalendarInfoW HeapLock GetCurrentConsoleFont SetCommMask FoldStringW GetDefaultCommConfigA lstrcatW FreeEnvironmentStringsW EnumDateFormatsW DebugBreak GetLastError HeapFree HeapAlloc GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc ExitProcess WriteFile GetStdHandle GetModuleFileNameA ReadFile SetHandleCount GetFileType GetStartupInfoA GetModuleFileNameW GetEnvironmentStringsW GetCommandLineW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount RtlUnwind MultiByteToWideChar SetStdHandle WriteConsoleA GetConsoleOutputCP LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize FlushFileBuffers CreateFileA CloseHandle GetModuleHandleA

user32

GetActiveWindow IntersectRect

Name

.text

Size

153KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

NieqmgdA

Size

70KB

Virtual Size

70KB

Characteristics

Name

HwUMAlHk

Size

1024B

Virtual Size

983B

Characteristics

Name

jpXNuQom

Size

40KB

Virtual Size

39KB

Characteristics

Name

OCsEGWAp

Size

1024B

Virtual Size

678B

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-11_0e0c43843607e7406d77358321b48ef1_amadey_cobalt-strike_elex_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee

kernel32

user32

generic