2026-07-01_03b8dad088a8a62752ab4962909d5620_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

General

Target
2026-07-01_03b8dad088a8a62752ab4962909d5620_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader
Size 230KB
Sample260701-mxvwqaet3w
SHA256 84a732ae245f7b50f8a6676f7ab5ffb3aecacb60589866ed874c1b9049ffa7c6
MD5 03b8dad088a8a62752ab4962909d5620
SHA1 99e84ae586e14246ef1427ece22bf428f1fe1603
SHA512 33b8183061efc55461be705b016bf1b5e29147b17aad28bf172fd192d2526a8864a130ae9277d5f179004ced58d63b5d7d58f086fcd0edbe5aa4c78658b46fae
SSDEEP 3072:HN467N+kRX190xNfoVS4j4ZHFFmuKGt++s+HBs8RZ0UN81xsZM8EdT7xcQxibjtb:B9P6eGc+zi62eMxsSdOQxi3tGPd
TLSH
T16D347D10B991C433D566543649A9DF76493DBC604F60A6CBB7801EFECE306C1AB39B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-01_03b8dad088a8a62752ab4962909d5620_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

File Explorer

2026-07-01_03b8dad088a8a62752ab4962909d5620_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

.exe 230KB

2026-07-01_03b8dad088a8a62752ab4962909d5620_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

IMPHASH 1705dd694757ca871a75314cd10ce6db
SHA256 84a732ae245f7b50f8a6676f7ab5ffb3aecacb60589866ed874c1b9049ffa7c6
MD5 03b8dad088a8a62752ab4962909d5620
SHA1 99e84ae586e14246ef1427ece22bf428f1fe1603
SHA512 33b8183061efc55461be705b016bf1b5e29147b17aad28bf172fd192d2526a8864a130ae9277d5f179004ced58d63b5d7d58f086fcd0edbe5aa4c78658b46fae
SSDEEP 3072:HN467N+kRX190xNfoVS4j4ZHFFmuKGt++s+HBs8RZ0UN81xsZM8EdT7xcQxibjtb:B9P6eGc+zi62eMxsSdOQxi3tGPd
TLSH
T16D347D10B991C433D566543649A9DF76493DBC604F60A6CBB7801EFECE306C1AB39B4B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

48448

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

bcrypt

BCryptDestroyKey BCryptEncrypt BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider BCryptSetProperty BCryptOpenAlgorithmProvider

advapi32

ConvertSidToStringSidA ReportEventA RegisterEventSourceA DeregisterEventSource GetTokenInformation OpenProcessToken

kernel32

GetProcessHeap SetStdHandle HeapSize CreateFileW SetEnvironmentVariableW CreateFileA DeleteFileA FindClose FindFirstFileW FindNextFileW GetFileSize ReadFile WriteFile CloseHandle Sleep GetCurrentProcess LocalFree WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsProcessorFeaturePresent SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead FreeEnvironmentStringsW RaiseException RtlUnwind WriteConsoleW GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress GetModuleFileNameW GetStdHandle GetCommandLineA GetCommandLineW HeapAlloc HeapFree IsDebuggerPresent UnhandledExceptionFilter GetFileType VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetACP GetOEMCP FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindFirstFileExW GetEnvironmentStringsW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-01_03b8dad088a8a62752ab4962909d5620_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

bcrypt

advapi32

kernel32

generic