ba6df378838d43e919fcfa5fb634f359944eca261691434d74c3ca398654b719

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 13:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_97e3fb97f117c3b3fa847a4b3ea933ae_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 247KB
Sample260604-qgbppafs21
SHA256 ba6df378838d43e919fcfa5fb634f359944eca261691434d74c3ca398654b719
MD5 97e3fb97f117c3b3fa847a4b3ea933ae
SHA1 db9350c4a805ba6318e51678e09abdd06e604270
SHA512 a9bd0ec16b2dc223beb190f42430beafefa38e3a7d5555a3a6ab578f917d57b1f20b6c5015cbdbdfc075e823c236a85a8d74b9ded8aea74c4bba2b3148dd047c
SSDEEP 6144:7uJWqml5a6EdkQxiUmRQColKGAOPQK2GwIgfx+qSfF0:gml5a6EdkQgUmR7G9QK3wJx+qSfF0
TLSH
T1D8349E12B5E180B3E9B30D3409F4AE759ABEF9310B158A7F63D84B6D5F30681D226763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3088	Logo1_.exe
3596	2026-06-04_97e3fb97f117c3b3fa847a4b3ea933ae_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_2021.2104.2.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Mu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\TerminalAzBridge.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\VisualElements\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\be\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\meta_engine\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Resources\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Assets\Images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_x64__8wekyb3d8bbwe\XboxStub.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\home-view\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ca-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ja\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftStickyNotes_4.0.2.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\WidevineCdm\_platform_specific\win_x64\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\es-ES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\lib-amd\colors\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	2026-06-04_97e3fb97f117c3b3fa847a4b3ea933ae_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\Logo1_.exe	2026-06-04_97e3fb97f117c3b3fa847a4b3ea933ae_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_97e3fb97f117c3b3fa847a4b3ea933ae_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_97e3fb97f117c3b3fa847a4b3ea933ae_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3088	Logo1_.exe
3088	Logo1_.exe
3088	Logo1_.exe
3088	Logo1_.exe
3088	Logo1_.exe
3088	Logo1_.exe
3088	Logo1_.exe
3088	Logo1_.exe
3088	Logo1_.exe
3088	Logo1_.exe
3088	Logo1_.exe
3088	Logo1_.exe
3088	Logo1_.exe
3088	Logo1_.exe
3088	Logo1_.exe
3088	Logo1_.exe
3088	Logo1_.exe
3088	Logo1_.exe
3088	Logo1_.exe
3088	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 3432	4116	2026-06-04_97e3fb97f117c3b3fa847a4b3ea933ae_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe	82
PID 4116 wrote to memory of 3088	4116	2026-06-04_97e3fb97f117c3b3fa847a4b3ea933ae_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe	83
PID 3088 wrote to memory of 4860	3088	Logo1_.exe	85
PID 4860 wrote to memory of 4016	4860	net.exe	87
PID 3432 wrote to memory of 3596	3432	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-06-04_97e3fb97f117c3b3fa847a4b3ea933ae_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_97e3fb97f117c3b3fa847a4b3ea933ae_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFCAF.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3432
- - C:\Users\Admin\AppData\Local\Temp\2026-06-04_97e3fb97f117c3b3fa847a4b3ea933ae_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-04_97e3fb97f117c3b3fa847a4b3ea933ae_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3596
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3088
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DebugOut.exe

Path C:\Program Files\DebugOut.exe
Size 313KB
SHA256 782bf671f687af0e3da388d5f13e8dddf50886bbc26969d57e3b1a6010ff3f81
MD5 91d4780e91572632d6adf871c6b4f81c
SHA1 0e012401a9adeddb49a7021a4f7b4dddfb631a7a
SHA512 c0fe701d164116839ff48265fcd671b7d1f4e2f19f296e8ce44aa3ae75228dc5a6dccce0af49c1332de3fccf700dce00ac12e8053b97f5866a1a1d899fbe35f2
SSDEEP 6144:7uJ8cHApLFLxmYbbPfltigNcaCYpXkv1iTZZdxhvt+m:MHoFVnPf+gRTUv1iNRJt+m
TLSH
T15B64239323846B61F296BE7B08FBD81774A7E200DDA8490BCE7D4E768CE4444F93554B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 484KB
SHA256 c000f77b3afd8a0b1498a05f29615e67e9c2aab43693eccf26bb3900ecaf4c38
MD5 8419ad26d74e72ac5c95948f1323ceb3
SHA1 e2db2dda085f42d9d92a88616a441a8fcf420f61
SHA512 cf1e3c51c7608a32d02a42ec4e6293f1c02933c293208a0175d22211b0fbc0f51c06c942eab2a72ca8a02973b09d65130836ecd3652b6730733581eb61eb1531
SSDEEP 6144:wuuJMqIuRebMq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1Oi9+8Vl9fA4:w4qIOkU8AMXE9B7PElZlP41N+4PUWfo
TLSH
T1B9B47D31E6A44037D6F106B3F925D6307E7DA2187B1184AB9394AE1D3EA8497A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$aFCAF.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aFCAF.bat
Size 1022B
SHA256 1dda864a895e5db532df2964ddf9dd20d00a01f323cd409c8567c9ad215252af
MD5 f16c90238d84e83d6766516c1caa5b38
SHA1 cd70077e11829d4b64572b3ffcd386ba111c7e5e
SHA512 7f07c76238ee7c49646fc72fdd9b8f3ae19047d6014bc8d4208527f6c1d998acf55c22cff917b7ceeb4ba49e1c4df2c124225b44b26b4820042a4221363b3f5f
TLSH
T1E111B40A4A6BEB9A1265908786B16DCFC511371A3A172323B3E4855E98D09CDF2E734A
MD5 SHA1 SHA512 TLSH

Submit Download

2026-06-04_97e3fb97f117c3b3fa847a4b3ea933ae_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-06-04_97e3fb97f117c3b3fa847a4b3ea933ae_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe
Size 217KB
SHA256 04adf40ba58d0ab892091c188822191f2597bc47dab8b92423e8fc546dc437ef
MD5 021c57c74de40f7c3b4fcf58a54d3649
SHA1 ef363ab45b6fe3dd5b768655adc4188aadf6b6fd
SHA512 77e3bbb08c661285a49a66e8090a54f535727731c44b7253ea09ffe9548bae9d120ef38a67dfa8a5d8da170dde3e9c1928b96c64dfc07b7f67f93b478937c018
SSDEEP 6144:Bqml5a6EdkQxiUmRQColKGAOPQK2GwIgfx+qSfF0:gml5a6EdkQgUmR7G9QK3wJx+qSfF0
TLSH
T1D9248E12B5E180B3E9B3093409F4AE759ABEB9310B258A7F63D84F6D5F30681D216773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 29KB
SHA256 5988d97fbb78c02498150b678f5b55e0f25a242db3c34f408b6eba9fe40b9304
MD5 34c67d884ee2f13ab12032cb994aaa98
SHA1 005446a9898ccd358dcc21fbb926df181afd340f
SHA512 d6a3f6ca4629a2d02c27b6db7f11344ea8782cff8e614d4783549fd5f9b5ae0b55718b0e963ecfe87705877c4668f6e75214e42c448490574e986440f7713a4f
SSDEEP 384:NbbtW2wwo4P+WBY1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOn:p5W2K16GVRu1yK9fMnJG2V9dHS8
TLSH
T1A1D2E17073ED6EB3F2921FF058B34FAB443BF110EC4AD15F5E6896994CA094089B6917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-1679180529-4058988202-686829476-1000\_desktop.ini
Size 8B
SHA256 055ea376e2004e4bba4864f8580ed635e094eb2dded0034a71189c056021dad9
MD5 2f4a1f0fa04a55f8ce91a6bd1ca42ff3
SHA1 63b897dffe8c5c30b66a5d3288269a0cc51d444c
SHA512 c60f3c126f620affacb594e7729fcb10a604c00b94be12a51b41dd10d0aa0bbfbf86aa58534a86d1fb9ff22579b22d6db87ee065ff35d0ede612774564c043e5
MD5 SHA1 SHA512

Submit Download

memory/3088-27-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3088-20-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3088-33-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3088-37-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3088-8-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3088-628-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3088-1225-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3088-5006-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3088-5509-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4116-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4116-13-0x0000000000400000-0x0000000000436000-memory.dmp

Download