2026-05-06_7b2eebe1edb0c9f740781a77fa12f496_amadey_cobalt-strike_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

General

Target
2026-05-06_7b2eebe1edb0c9f740781a77fa12f496_amadey_cobalt-strike_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
Size 150KB
Sample260506-gbp6fsey2n
SHA256 e0f76f03718c2f35593d611eccb71e39a569f1216870c770b6c3fda7adc244dc
MD5 7b2eebe1edb0c9f740781a77fa12f496
SHA1 54b898f355b6bebd8860ba8f1657da116759ad63
SHA512 bedf25d32a816e88a0a8e329ff83dae720f7777bd76cfa89d2331f622a39517c958d81683ee7c1cc8081b42014e347f44273ff32ce72f843349704d646384122
SSDEEP 1536:CE3qz4ayX9ioT5Xl8lQWj1vTo5G6kvBzodfjZw4jk5tGwtsJ4WvLKb7TQdL31Aq2:/79l86WqGzIfjZwik5tEiw3mkRqezW
TLSH
T1A2E38D1A7959E4F3C5258A305868D7B2973AB8317E706683FBC4036E8DB72D05E3B712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-06_7b2eebe1edb0c9f740781a77fa12f496_amadey_cobalt-strike_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-05-06_7b2eebe1edb0c9f740781a77fa12f496_amadey_cobalt-strike_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

.exe 150KB

2026-05-06_7b2eebe1edb0c9f740781a77fa12f496_amadey_cobalt-strike_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 46d622f7b3a9583c2976072cd46d3373
SHA256 e0f76f03718c2f35593d611eccb71e39a569f1216870c770b6c3fda7adc244dc
MD5 7b2eebe1edb0c9f740781a77fa12f496
SHA1 54b898f355b6bebd8860ba8f1657da116759ad63
SHA512 bedf25d32a816e88a0a8e329ff83dae720f7777bd76cfa89d2331f622a39517c958d81683ee7c1cc8081b42014e347f44273ff32ce72f843349704d646384122
SSDEEP 1536:CE3qz4ayX9ioT5Xl8lQWj1vTo5G6kvBzodfjZw4jk5tGwtsJ4WvLKb7TQdL31Aq2:/79l86WqGzIfjZwik5tEiw3mkRqezW
TLSH
T1A2E38D1A7959E4F3C5258A305868D7B2973AB8317E706683FBC4036E8DB72D05E3B712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

28911

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegSetValueExA LookupPrivilegeValueA RegOpenKeyA AdjustTokenPrivileges RegCloseKey OpenProcessToken

kernel32

ExitProcess CreateFileA GetFileSize SetFilePointer GetCurrentProcess WaitForSingleObject GetTickCount WriteFile Sleep CreateProcessA ReadFile GetSystemDirectoryA GetEnvironmentVariableA CreateDirectoryA GetLastError GetProcAddress CopyFileA LoadLibraryA CreatePipe GetModuleFileNameA CreateMutexA GetVersionExA WinExec CloseHandle GetTempPathA DeleteFileA MoveFileA HeapFree HeapAlloc HeapReAlloc GetSystemTimeAsFileTime GetCommandLineA GetStartupInfoA TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent WideCharToMultiByte GetTimeZoneInformation HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc GetModuleHandleW GetStdHandle TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCPInfo GetACP GetOEMCP IsValidCodePage RaiseException FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetCurrentProcessId GetConsoleCP GetConsoleMode MultiByteToWideChar InitializeCriticalSectionAndSpinCount RtlUnwind LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW FlushFileBuffers CompareStringA CompareStringW SetEnvironmentVariableA

Name

.text

Size

75KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

GXcGEFyr

Size

42KB

Virtual Size

42KB

Characteristics

Name

PWDvNNIP

Size

4KB

Virtual Size

3KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-06_7b2eebe1edb0c9f740781a77fa12f496_amadey_cobalt-strike_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

advapi32

kernel32

generic