2026-04-12_cfefe4e3576a16369b7563f6f59b7fbb_amadey_cobalt-strike_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-12_cfefe4e3576a16369b7563f6f59b7fbb_amadey_cobalt-strike_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
Size 534KB
Sample260412-bthansbw8q
SHA256 2a316ea8c2c0148f2e5aba36c289f3c49f5ce70ddbab6ae0af242d4fc4e0c1fd
MD5 cfefe4e3576a16369b7563f6f59b7fbb
SHA1 0ba07f678855dc140fb2ca4934a0c0b0bc720496
SHA512 da1df69cfec23b2baf4a30a3f8e5e5e34a7c08f7b8e9b110e7c6f684d7d16045835af2aa3d5c6450ec835e23981d993b8f6322cc32a2031e17d22b4212e7ae32
SSDEEP 6144:xzNMJBjynosFTmGyOaFwBYMc7UEQxZaDFaLfojoDeTymSqer5+nDFo:xzNgORZmGyOaOi7YxFDo02der5+nZo
TLSH
T19DC49E0A76B9BDE1D5B24E329C1DD5E4A72FB852EE401B6725D4731F1C762B0CE22B20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-12_cfefe4e3576a16369b7563f6f59b7fbb_amadey_cobalt-strike_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-04-12_cfefe4e3576a16369b7563f6f59b7fbb_amadey_cobalt-strike_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

.exe 534KB

2026-04-12_cfefe4e3576a16369b7563f6f59b7fbb_amadey_cobalt-strike_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 9eefacf83d553309fed787be341d76f9
SHA256 2a316ea8c2c0148f2e5aba36c289f3c49f5ce70ddbab6ae0af242d4fc4e0c1fd
MD5 cfefe4e3576a16369b7563f6f59b7fbb
SHA1 0ba07f678855dc140fb2ca4934a0c0b0bc720496
SHA512 da1df69cfec23b2baf4a30a3f8e5e5e34a7c08f7b8e9b110e7c6f684d7d16045835af2aa3d5c6450ec835e23981d993b8f6322cc32a2031e17d22b4212e7ae32
SSDEEP 6144:xzNMJBjynosFTmGyOaFwBYMc7UEQxZaDFaLfojoDeTymSqer5+nDFo:xzNgORZmGyOaOi7YxFDo02der5+nZo
TLSH
T19DC49E0A76B9BDE1D5B24E329C1DD5E4A72FB852EE401B6725D4731F1C762B0CE22B20
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

250125

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

EnumCalendarInfoW InterlockedDecrement GetCurrentProcess GetLogicalDriveStringsW SetEnvironmentVariableW SetVolumeMountPointW GetTimeFormatA GetTickCount CreateNamedPipeW LocalFlags GetNumberFormatA ClearCommBreak GetConsoleAliasExesW GetEnvironmentStrings LoadLibraryW GetLocaleInfoW _hread GetCalendarInfoW SetVolumeMountPointA GetVersionExW EnumSystemCodePagesA CreateSemaphoreA GetFileAttributesW GetModuleFileNameW CreateActCtxA GetShortPathNameA CreateJobObjectA VerifyVersionInfoW InterlockedExchange InterlockedIncrement GetLastError GetCurrentDirectoryW GetProcAddress CopyFileA SetComputerNameA SetFileAttributesA DefineDosDeviceA GlobalFree FindClose LoadLibraryA LocalAlloc CreateHardLinkW GetNumberFormatW OpenEventA FoldStringW SetEnvironmentVariableA GlobalWire GetModuleFileNameA EnumDateFormatsA GetShortPathNameW SetFileShortNameA GetDiskFreeSpaceExA ReadConsoleInputW DebugBreak GetTempPathA TlsFree LCMapStringW CreateProcessW CommConfigDialogA EnumCalendarInfoA SetFilePointer GetStdHandle GetComputerNameA CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA CloseHandle FlushFileBuffers MultiByteToWideChar HeapFree UnhandledExceptionFilter SetUnhandledExceptionFilter HeapReAlloc HeapAlloc GetStartupInfoW RaiseException RtlUnwind TerminateProcess IsDebuggerPresent GetCPInfo GetACP GetOEMCP IsValidCodePage GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue SetLastError GetCurrentThreadId HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc Sleep HeapSize ExitProcess WriteFile SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringA WideCharToMultiByte GetStringTypeA GetStringTypeW GetLocaleInfoA InitializeCriticalSectionAndSpinCount SetStdHandle GetModuleHandleA GetConsoleCP GetConsoleMode

gdi32

CreateDCW GetCharWidth32A GetCharWidthI

advapi32

ReadEventLogW

ole32

CoSuspendClassObjects

winhttp

WinHttpOpen WinHttpSetDefaultProxyConfiguration

msimg32

AlphaBlend

Name

.text

Size

294KB

Virtual Size

294KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

24KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.natak

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.nayi

Size

512B

Virtual Size

214B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

96KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

FoaUMzlH

Size

16KB

Virtual Size

16KB

Characteristics

Name

KxZWvPmT

Size

1024B

Virtual Size

944B

Characteristics

Name

BeMNnDTc

Size

91KB

Virtual Size

91KB

Characteristics

Name

ohSxurLO

Size

512B

Virtual Size

262B

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-12_cfefe4e3576a16369b7563f6f59b7fbb_amadey_cobalt-strike_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

kernel32

gdi32

advapi32

ole32

winhttp

msimg32

generic