Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
22/04/2026, 18:05
Behavioral task
behavioral1
Sample
2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe
- Size 482KB
- Sample260422-wphe4adv3m
- SHA256 456cc46478a1a0223364fa0988c94b2354745512a9a5673b10c2474daf8d9ac4
- MD5 f15d3566f3f66b1baaedf3b7750b0a0b
- SHA1 778a11dcc24c3d7278d364699334936759e343fb
- SHA512 7a44b0060c883474ea35c27130993d26494085187353523b16a48e03d5d7fdc78a361c5c45a526c51e8552036fbe5cdd4c7731d5d9848af47f2a08c9b6c8c2e1
- SSDEEP 6144:AU7K+oGB3Pa87T4DtLUjD5xS8LjN7TqK8tspTK9J2JPT/SUxCtnRPF9cCGrI2vl:IYiGTyUjD5xS8LjBTqKPK9ZBnRNhcvl
- TLSH T1CFA4AF12BAC0D033E5650530182E8BB69B7EFC751BA15F8727807A7DBE317C0A939A57
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 1 IoCs
resource yara_rule behavioral2/files/0x001a00000002b36a-8.dat family_shodi - Executes dropped EXE 1 IoCs
pid Process 2944 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.usa - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\UsaShohdi.asu 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.usa 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSQRY32.usa 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.usa 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.usa 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.usa 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.usa 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ORGCHART.usa 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.usa 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Mozilla Firefox\updater.exe 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\updater.usa 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.usa 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ONENOTE.usa 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.usa 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.usa 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeComRegisterShellARM64.exe 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.usa 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SDXHelper.usa 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Mozilla Firefox\firefox.exe 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\maintenanceservice.usa 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.usa 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.usa 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateComRegisterShell64.usa 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.usa 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\7-Zip\Uninstall.exe 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.usa 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.usa 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.usa 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SETLANG.usa 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.usa 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.usa 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jconsole.usa 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\Wordconv.usa 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.usa - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4292 wrote to memory of 2944 4292 2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.usa2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2944
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.usa
- Path C:\Users\Admin\AppData\Local\Temp\2026-04-22_f15d3566f3f66b1baaedf3b7750b0a0b_amadey_cloudeye_cobalt-strike_elex_luca-stealer_rhadamanthys_smoke-loader.usa
- Size 140KB
- SHA256 a09f012723c5425bb928399302eb90362116855b3d0612347e76e8b7c82127b7
- MD5 9c98d1a23efaf1b156a130cea7d2ee3a
- SHA1 947a300323ce1b2468422ad62316cb5da039e423
- SHA512 f74396ce284ca7f02f51474ddec39629310451743e7ca08deda9f43cb314d97c7671ea3c504f3f09495e733a6b9bc196ae971553e9e3c4741b287e613be6ef6f
- SSDEEP 3072:1JEXiJu7COG12zuf9AxnPKiadKSUoxzWCtnRPF9EVnb43jaI5grI2v0:0K9J2JPT/SUxCtnRPF9cCGrI2v
- TLSH T198E3AF13BAC1D475F671083428769A91CA3FFC815F615EAB3B98357A4F342C09932EA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\UsaShohdi.asu
- Size 482KB
- SHA256 0eb7fd990f67b654b6c1912dc6b9007cac942c4cd08acaf74ae5f9c7a5ba7516
- MD5 bc2648cdf5e6650a1721b97ab86bf4f2
- SHA1 f19e2a4c8f96c27c7d98453d5caff93e69e4419b
- SHA512 c4fd207af484b3d250b0b9e417063f49d8a81bd437ef391b5eba7950ee62d7b9556598b6698124157a73b9992f1506e606706322aabd050eb4b88383216993f5
- SSDEEP 6144:AUj+oGB3Pa87T4DtLUjD5xS8LjN7TqK8tspTK9J2JPT/SUxCtnRPF9cCGrI2vl:BYiGTyUjD5xS8LjBTqKPK9ZBnRNhcvl
- TLSH T142A4AF12BAC0C033E5650530182E8BB69B7EFC751BA15F8727807A7DBE317C1A939A57
- MD5 SHA1 SHA512 SSDEEP TLSH