Analysis
- max time kernel
149s - max time network
148s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
17/05/2026, 13:19
General
- Target 2026-05-17_b79b7ca44c814f3fd6517e30e0f676d4_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
- Size 402KB
- Sample260517-qkmalacv4j
- SHA256 95bb0d57e871c9e6faa76af703b412be23040b07c122b69cf9928af5b4d4501e
Malware Config
Extracted
-
redline
-
furga
-
83.97.73.128:19071
-
auth_value
1b7af6db7a79a3475798fcf494818be7
Signatures
- Family: RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- Detects executables packed with ConfuserEx Mod 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-17_b79b7ca44c814f3fd6517e30e0f676d4_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-17_b79b7ca44c814f3fd6517e30e0f676d4_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3200-0-0x0000000000750000-0x0000000000780000-memory.dmp
memory/3200-4-0x0000000002450000-0x0000000002456000-memory.dmp
memory/3200-5-0x0000000004CB0000-0x00000000052C8000-memory.dmp
memory/3200-6-0x0000000005300000-0x000000000540A000-memory.dmp
memory/3200-8-0x0000000005440000-0x0000000005452000-memory.dmp
memory/3200-7-0x0000000002440000-0x0000000002450000-memory.dmp
memory/3200-9-0x0000000005460000-0x000000000549C000-memory.dmp
memory/3200-10-0x0000000005500000-0x000000000554C000-memory.dmp
memory/3200-11-0x0000000002440000-0x0000000002450000-memory.dmp