2026-04-12_159b8a7f5e9bad50d19afcbed405f488_amadey_cobalt-strike_elex_icedid_njrat_rhadamanthys_smoke-loader_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-12_159b8a7f5e9bad50d19afcbed405f488_amadey_cobalt-strike_elex_icedid_njrat_rhadamanthys_smoke-loader_stealc_stop
Size 338KB
Sample260412-a7f44aev4v
SHA256 8a06134daa385d8e345e026f79371afeb52a0fba668511affdefd9cba51c2466
MD5 159b8a7f5e9bad50d19afcbed405f488
SHA1 e2a9eee572382a16661f70b71c67f2fa5901d9ca
SHA512 30f34630a11bd0948d93ee8c8b4de642399a50296235f8f1e8bf16b6d5bde8c23f7ceba02544e2b96b796d0f6eabfbfdd776512d9cc81f4a0c4413cc333ff80a
SSDEEP 6144:yELgQvELJn79vTHRNvTotvT4USqer5+nDFoycQ:yEUUIp97xq6ger5+nZoy
TLSH
T169746C0936B5D4D7F6B38E3C5C708E9C66F7B8E36D61462B15C0521E5C362A38E22F26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-12_159b8a7f5e9bad50d19afcbed405f488_amadey_cobalt-strike_elex_icedid_njrat_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-04-12_159b8a7f5e9bad50d19afcbed405f488_amadey_cobalt-strike_elex_icedid_njrat_rhadamanthys_smoke-loader_stealc_stop

.exe 338KB

2026-04-12_159b8a7f5e9bad50d19afcbed405f488_amadey_cobalt-strike_elex_icedid_njrat_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 82c6c5dba11f93a82c3bf13dc3056a96
SHA256 8a06134daa385d8e345e026f79371afeb52a0fba668511affdefd9cba51c2466
MD5 159b8a7f5e9bad50d19afcbed405f488
SHA1 e2a9eee572382a16661f70b71c67f2fa5901d9ca
SHA512 30f34630a11bd0948d93ee8c8b4de642399a50296235f8f1e8bf16b6d5bde8c23f7ceba02544e2b96b796d0f6eabfbfdd776512d9cc81f4a0c4413cc333ff80a
SSDEEP 6144:yELgQvELJn79vTHRNvTotvT4USqer5+nDFoycQ:yEUUIp97xq6ger5+nZoy
TLSH
T169746C0936B5D4D7F6B38E3C5C708E9C66F7B8E36D61462B15C0521E5C362A38E22F26
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6416

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SearchPathW GetConsoleAliasesLengthW GetNumaProcessorNode GetDefaultCommConfigW GetCommState InterlockedDecrement QueryDosDeviceA GetEnvironmentStringsW InterlockedCompareExchange GetComputerNameW ConnectNamedPipe GetModuleHandleW ReadConsoleW ReadConsoleOutputA SetCommState GetPriorityClass LoadLibraryW CopyFileW GetConsoleAliasExesLengthW FormatMessageW GetSystemTimeAdjustment DeleteVolumeMountPointW HeapDestroy SetConsoleMode GetFileAttributesW GetBinaryTypeA GetShortPathNameA GetLastError GetLongPathNameW GetProcAddress SetStdHandle LoadLibraryA LocalAlloc MoveFileA FindAtomA GetModuleFileNameA FreeEnvironmentStringsW BuildCommDCBA FatalAppExitA WriteConsoleOutputAttribute ReleaseMutex GetVolumeInformationW HeapFree HeapAlloc HeapReAlloc Sleep ExitProcess GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc WriteFile GetStdHandle TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InitializeCriticalSectionAndSpinCount GetModuleFileNameW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize GetLocaleInfoA WideCharToMultiByte LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW

user32

GetFocus

Name

.text

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

991KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.yiyaluz

Size

512B

Virtual Size

124B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.cewek

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

118KB

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

zdvcukul

Size

116KB

Virtual Size

116KB

Characteristics

Name

FGWlgwsf

Size

3KB

Virtual Size

3KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-12_159b8a7f5e9bad50d19afcbed405f488_amadey_cobalt-strike_elex_icedid_njrat_rhadamanthys_smoke-loader_stealc_stop

kernel32

user32

generic