2026-04-11_6c1adf820d63235ba1e191ee83db4975_amadey_cobalt-strike_elex_icedid_njrat_redline-stealer_rhadamanthys_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-11_6c1adf820d63235ba1e191ee83db4975_amadey_cobalt-strike_elex_icedid_njrat_redline-stealer_rhadamanthys_stealc
Size 531KB
Sample260411-pystvsfz2r
SHA256 d56d03a28fceb84811de44e8daa0b1f185d080429c39da3f20490de38338c5bf
MD5 6c1adf820d63235ba1e191ee83db4975
SHA1 d871d9f041e9e47e6bf6712754f74e84de08a9c4
SHA512 7ce99055d5b27faf1f25935e07383dfd6b19c452109db666494b941386b62f6c573e03e8e02d89a231d72281b05aaaa87cf88a607258c84573b55081f8c34d6d
SSDEEP 12288:TfaWszqh3xwyHSWDXer5+nZoFer5+nZo:TfPZhBwLWDvi
TLSH
T13BC45C0E367574E2D5724F309C2486A0567BB8A37E51AAAB29C4931E4C773F4CE27F24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-11_6c1adf820d63235ba1e191ee83db4975_amadey_cobalt-strike_elex_icedid_njrat_redline-stealer_rhadamanthys_stealc

File Explorer

2026-04-11_6c1adf820d63235ba1e191ee83db4975_amadey_cobalt-strike_elex_icedid_njrat_redline-stealer_rhadamanthys_stealc

.exe 531KB

2026-04-11_6c1adf820d63235ba1e191ee83db4975_amadey_cobalt-strike_elex_icedid_njrat_redline-stealer_rhadamanthys_stealc

IMPHASH 52f2688274226e8e29c159bfb480bb47
SHA256 d56d03a28fceb84811de44e8daa0b1f185d080429c39da3f20490de38338c5bf
MD5 6c1adf820d63235ba1e191ee83db4975
SHA1 d871d9f041e9e47e6bf6712754f74e84de08a9c4
SHA512 7ce99055d5b27faf1f25935e07383dfd6b19c452109db666494b941386b62f6c573e03e8e02d89a231d72281b05aaaa87cf88a607258c84573b55081f8c34d6d
SSDEEP 12288:TfaWszqh3xwyHSWDXer5+nZoFer5+nZo:TfPZhBwLWDvi
TLSH
T13BC45C0E367574E2D5724F309C2486A0567BB8A37E51AAAB29C4931E4C773F4CE27F24
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17351

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleExA SetLocalTime BuildCommDCBAndTimeoutsA SetUnhandledExceptionFilter WaitNamedPipeA GlobalSize GetEnvironmentStringsW GetUserDefaultLCID InterlockedCompareExchange WriteConsoleInputA SetEvent CreateDirectoryExA CallNamedPipeW GetModuleHandleW CreateRemoteThread GetDateFormatA WriteFile FindActCtxSectionStringA GetDriveTypeA AllocateUserPhysicalPages GlobalAlloc GetSystemDirectoryW ReadFileScatter GetVersionExW DnsHostnameToComputerNameW FindNextVolumeW GetConsoleAliasW GetFileAttributesW GetModuleFileNameW EnumCalendarInfoA FindNextVolumeMountPointW EnumSystemLocalesA GetConsoleOutputCP OpenMutexW SetLastError GetProcAddress GetComputerNameExW LoadLibraryA LocalAlloc SetCalendarInfoW RemoveDirectoryW GlobalGetAtomNameW GetCommMask RtlCaptureStackBackTrace GlobalFindAtomW EnumResourceTypesW FindNextFileA GetModuleHandleA EraseTape CreateMutexA GetStringTypeW RequestWakeupLatency ScrollConsoleScreenBufferA GetVolumeNameForVolumeMountPointW DeleteFileW GetFileInformationByHandle CloseHandle HeapSize MultiByteToWideChar lstrcmpA GetLastError DeleteFileA HeapReAlloc GetCommandLineA HeapSetInformation GetStartupInfoW GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage EncodePointer TlsAlloc TlsGetValue TlsSetValue DecodePointer TlsFree GetCurrentThreadId GetCurrentThread UnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess EnterCriticalSection LeaveCriticalSection HeapCreate HeapDestroy HeapFree HeapAlloc SetFilePointer ExitProcess GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringW FatalAppExitA Sleep GetLocaleInfoW GetLocaleInfoA IsValidLocale RtlUnwind SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers SetConsoleCtrlHandler FreeLibrary InterlockedExchange LoadLibraryW IsProcessorFeaturePresent WriteConsoleW CreateFileW

user32

GetMenu

advapi32

ReportEventA

Name

.text

Size

109KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

109KB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

61KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

deCMqGXb

Size

11KB

Virtual Size

10KB

Characteristics

Name

YgwRWWip

Size

512B

Virtual Size

31B

Characteristics

Name

mElXfGMs

Size

512B

Virtual Size

39B

Characteristics

Name

QzrCGEsJ

Size

1024B

Virtual Size

612B

Characteristics

Name

OKfRJATl

Size

5KB

Virtual Size

5KB

Characteristics

Name

hlWUZjdv

Size

1024B

Virtual Size

937B

Characteristics

Name

ZUPMRrEP

Size

19KB

Virtual Size

19KB

Characteristics

Name

NSQRKShk

Size

1024B

Virtual Size

786B

Characteristics

Name

sBeFrBtv

Size

6KB

Virtual Size

6KB

Characteristics

Name

aZbmAvsl

Size

512B

Virtual Size

91B

Characteristics

Name

fGkvbprC

Size

101KB

Virtual Size

100KB

Characteristics

Name

zqrsjhnB

Size

4KB

Virtual Size

3KB

Characteristics

Name

UCOyRyGn

Size

93KB

Virtual Size

92KB

Characteristics

Name

VVTOVlsD

Size

4KB

Virtual Size

3KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-11_6c1adf820d63235ba1e191ee83db4975_amadey_cobalt-strike_elex_icedid_njrat_redline-stealer_rhadamanthys_stealc

kernel32

user32

advapi32

generic