General
- Target 2026-07-06_4599fe561483729b75919a6ec9b0afb4_amadey_cobalt-strike_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_vidar
- Size 5.6MB
- Sample260706-spr3racy5j
- SHA256 c26617d4a6aa9c1a1ee5e41867fd7f8d5a72506fb46f8d6611bf688510dadaed
- MD5 4599fe561483729b75919a6ec9b0afb4
- SHA1 ff99936a3ac78baa2883577d062e31693325cf24
- SHA512 d1f41179b88ff32dd59e9c9bad200f16733d4748329b0799152c0eb20f785acfbe727ce819e5ba9f33f82f0f3a8bd0fbe11f73a617870d9a9b81965e5d60f368
- SSDEEP 49152:4iWSytLd2nTJPBMO+YrovpU/9FITeqass1TNeW4SkZP4sz9MbkqJtb2Ij56rbeWX:vstJROgveqijfkZckJr7fkZc
- TLSH T1AB46062DFD748E32D06680B5C592A76DEA323C018B214ACB5249BB6CFE73FD19535326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-06_4599fe561483729b75919a6ec9b0afb4_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_4599fe561483729b75919a6ec9b0afb4_amadey_cobalt-strike_elex_hijackloader_redline-stealer_r.exe
Resource
win11ltsc2024-20260630-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-06_4599fe561483729b75919a6ec9b0afb4_amadey_cobalt-strike_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_vidar
- Size 5.6MB
- SHA256 c26617d4a6aa9c1a1ee5e41867fd7f8d5a72506fb46f8d6611bf688510dadaed
- MD5 4599fe561483729b75919a6ec9b0afb4
- SHA1 ff99936a3ac78baa2883577d062e31693325cf24
- SHA512 d1f41179b88ff32dd59e9c9bad200f16733d4748329b0799152c0eb20f785acfbe727ce819e5ba9f33f82f0f3a8bd0fbe11f73a617870d9a9b81965e5d60f368
- SSDEEP 49152:4iWSytLd2nTJPBMO+YrovpU/9FITeqass1TNeW4SkZP4sz9MbkqJtb2Ij56rbeWX:vstJROgveqijfkZckJr7fkZc
- TLSH T1AB46062DFD748E32D06680B5C592A76DEA323C018B214ACB5249BB6CFE73FD19535326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory