Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
17/05/2026, 13:19
General
- Target 2026-05-17_b79b7ca44c814f3fd6517e30e0f676d4_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
- Size 402KB
- Sample260517-qkmalacv4j
- SHA256 95bb0d57e871c9e6faa76af703b412be23040b07c122b69cf9928af5b4d4501e
Malware Config
Extracted
-
redline
-
furga
-
83.97.73.128:19071
-
auth_value
1b7af6db7a79a3475798fcf494818be7
Signatures
- Family: RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- Detects executables packed with ConfuserEx Mod 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-17_b79b7ca44c814f3fd6517e30e0f676d4_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-17_b79b7ca44c814f3fd6517e30e0f676d4_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4304-0-0x00000000001C0000-0x00000000001F0000-memory.dmp
memory/4304-4-0x00000000026A0000-0x00000000026A6000-memory.dmp
memory/4304-5-0x000000000A6F0000-0x000000000AD08000-memory.dmp
memory/4304-6-0x000000000A0D0000-0x000000000A1DA000-memory.dmp
memory/4304-7-0x0000000004C40000-0x0000000004C50000-memory.dmp
memory/4304-8-0x0000000004BD0000-0x0000000004BE2000-memory.dmp
memory/4304-9-0x0000000004BF0000-0x0000000004C2C000-memory.dmp
memory/4304-10-0x0000000002550000-0x000000000259C000-memory.dmp
memory/4304-11-0x0000000004C40000-0x0000000004C50000-memory.dmp