General
- Target 2026-04-18_fd139c4eb33756a951e4fde9d1704720_amadey_cobalt-strike_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stop
- Size 271KB
- Sample260418-fl3c4aay5q
- SHA256 a503496e58bacafcbba70ff667cbd94b645b651f4ba28405a19cc082a20bb6ad
- MD5 fd139c4eb33756a951e4fde9d1704720
- SHA1 2dd16f753f92bdbead6b79daba88dda2314daacb
- SHA512 92d230712c16a0c36c2e3c981e6530fbad5493d8cdb33d384022543453aa5fc53c4e11b058162918a6999aa22a981186b6f20f8add9dfa5ad20a3e83f14811bf
- SSDEEP 3072:ezdQKR8K5ZTKqllZs5StBNmOReRQuKT0yB3kM8OHw3mkRqer5+ncloOZ4:ezGKLlKqllZAa5lZ8+Sqer5+nD
- TLSH T17E44AE1D3A90E4F2C5B14E3498E0E6D0D636FC63E95016A76AD8735F4D322E48E37B29
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-18_fd139c4eb33756a951e4fde9d1704720_amadey_cobalt-strike_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260130-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-18_fd139c4eb33756a951e4fde9d1704720_amadey_cobalt-strike_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Resource
win11-20260130-en
3 signatures
150 seconds
Malware Config
Extracted
Family
-
smokeloader
Botnet
-
pub2
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://aucmoney.com/upload/
-
http://thegymmum.com/upload/
-
http://atvcampingtrips.com/upload/
-
http://kuapakualaman.com/upload/
-
http://renatazarazua.com/upload/
-
http://nasufmutlu.com/upload/
rc4.i32
rc4.i32
Targets
-
- Target 2026-04-18_fd139c4eb33756a951e4fde9d1704720_amadey_cobalt-strike_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stop
- Size 271KB
- SHA256 a503496e58bacafcbba70ff667cbd94b645b651f4ba28405a19cc082a20bb6ad
- MD5 fd139c4eb33756a951e4fde9d1704720
- SHA1 2dd16f753f92bdbead6b79daba88dda2314daacb
- SHA512 92d230712c16a0c36c2e3c981e6530fbad5493d8cdb33d384022543453aa5fc53c4e11b058162918a6999aa22a981186b6f20f8add9dfa5ad20a3e83f14811bf
- SSDEEP 3072:ezdQKR8K5ZTKqllZs5StBNmOReRQuKT0yB3kM8OHw3mkRqer5+ncloOZ4:ezGKLlKqllZAa5lZ8+Sqer5+nD
- TLSH T17E44AE1D3A90E4F2C5B14E3498E0E6D0D636FC63E95016A76AD8735F4D322E48E37B29
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Deletes itself