General
- Target 2026-04-12_d343d73d4856f8f1d24b383c4e597b6f_amadey_cobalt-strike_elex_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 503KB
- Sample260412-bt4hxabx2j
- SHA256 e73ec15f305eff29794bfaed2986ca49cd680ac136b4475c7faf92e5a7b4d1d3
- MD5 d343d73d4856f8f1d24b383c4e597b6f
- SHA1 77a1e8512bcfef929653bf174e6f02bd89530ee1
- SHA512 e98b757993142da44177b7927f85ec0944620b2cc00b045592e948af5d36f2ec28d8d1bc3eedad5efa2846e5beb579f97c2b84b3c19fc16598e29503c19c4c63
- SSDEEP 12288:gtjCzBdPMNBVh5GtjfJ8uq990UXNQUHller5+nZ:6wMNBVNqkj
- TLSH T14FB4AF0673E6F8F1D6724A308DA5CBE0AF3BB8615E5217E73684671F5C712A4CE62B10
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-12_d343d73d4856f8f1d24b383c4e597b6f_amadey_cobalt-strike_elex_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260130-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-12_d343d73d4856f8f1d24b383c4e597b6f_amadey_cobalt-strike_elex_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win11-20260130-en
11 signatures
150 seconds
Malware Config
Extracted
Family
-
smokeloader
Botnet
-
pub3
Extracted
Family
-
smokeloader
Version
-
2022
C2
-
http://nwgrus.ru/tmp/index.php
-
http://tech-servers.in.net/tmp/index.php
-
http://unicea.ws/tmp/index.php
rc4.i32
rc4.i32
Targets
-
- Target 2026-04-12_d343d73d4856f8f1d24b383c4e597b6f_amadey_cobalt-strike_elex_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 503KB
- SHA256 e73ec15f305eff29794bfaed2986ca49cd680ac136b4475c7faf92e5a7b4d1d3
- MD5 d343d73d4856f8f1d24b383c4e597b6f
- SHA1 77a1e8512bcfef929653bf174e6f02bd89530ee1
- SHA512 e98b757993142da44177b7927f85ec0944620b2cc00b045592e948af5d36f2ec28d8d1bc3eedad5efa2846e5beb579f97c2b84b3c19fc16598e29503c19c4c63
- SSDEEP 12288:gtjCzBdPMNBVh5GtjfJ8uq990UXNQUHller5+nZ:6wMNBVNqkj
- TLSH T14FB4AF0673E6F8F1D6724A308DA5CBE0AF3BB8615E5217E73684671F5C712A4CE62B10
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Smokeloader family
-
Deletes itself