2026-07-20_3980bdad156f05b91d725d26768c529a_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

General

Target
2026-07-20_3980bdad156f05b91d725d26768c529a_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader
Size 225KB
Sample260720-dttptagv3t
SHA256 e80bccba9b4df7311a91071ddd2e62a0365d0a494cf439c576219d6e7c65bdc2
MD5 3980bdad156f05b91d725d26768c529a
SHA1 20ec364118fc62a1e926b9a8a3ed3961600ea8a7
SHA512 04020cd45dd5ec9cdcfdd9f1caa3c558bc4d9e457fe410ecb57aa464a26b00ad01777d98613027378ff0910d2f40340b51f08dee0d64ac6e4b15748d4322e716
SSDEEP 3072:Op6+UlccUmUlBr9fMwFJ/65JAzEAM+fr01V5D9OgyX6PcReARizF+in+8a4JmqIo:O0eBr9jF98KtMaEPD9O5kckzVtI
TLSH
T194347C10B8418436E577183B89FA8F7A8A2DAC904B5466DBA3C41DFDCF346D0BB3564B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_3980bdad156f05b91d725d26768c529a_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

File Explorer

2026-07-20_3980bdad156f05b91d725d26768c529a_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

.exe 225KB

2026-07-20_3980bdad156f05b91d725d26768c529a_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

IMPHASH 186d984625ff4698259a21fa49ae9c1f
SHA256 e80bccba9b4df7311a91071ddd2e62a0365d0a494cf439c576219d6e7c65bdc2
MD5 3980bdad156f05b91d725d26768c529a
SHA1 20ec364118fc62a1e926b9a8a3ed3961600ea8a7
SHA512 04020cd45dd5ec9cdcfdd9f1caa3c558bc4d9e457fe410ecb57aa464a26b00ad01777d98613027378ff0910d2f40340b51f08dee0d64ac6e4b15748d4322e716
SSDEEP 3072:Op6+UlccUmUlBr9fMwFJ/65JAzEAM+fr01V5D9OgyX6PcReARizF+in+8a4JmqIo:O0eBr9jF98KtMaEPD9O5kckzVtI
TLSH
T194347C10B8418436E577183B89FA8F7A8A2DAC904B5466DBA3C41DFDCF346D0BB3564B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

46128

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

connect inet_pton WSACleanup WSAStartup socket send recv htons closesocket

advapi32

GetUserNameA

kernel32

ReadConsoleW ReadFile GetConsoleMode CreateFileW FlushFileBuffers HeapSize GetProcessHeap SetStdHandle GetConsoleOutputCP FlsFree CloseHandle Sleep GetComputerNameA CreateToolhelp32Snapshot Process32First Process32Next GetLastError GetCurrentThreadId WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceCounter GetSystemTimePreciseAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo IsProcessorFeaturePresent GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW SetEnvironmentVariableW RaiseException RtlUnwind SetLastError FlsAlloc FlsGetValue FlsSetValue WriteConsoleW DuplicateHandle GetCurrentProcess CreateProcessW CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess TerminateProcess GetProcAddress GetCommandLineA GetCommandLineW HeapAlloc HeapFree IsDebuggerPresent UnhandledExceptionFilter GetFileType WaitForSingleObject GetExitCodeProcess GetFileAttributesExW CreatePipe VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetACP GetOEMCP SetFilePointerEx HeapReAlloc FindClose FindFirstFileExW FindNextFileW GetEnvironmentStringsW FreeEnvironmentStringsW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_3980bdad156f05b91d725d26768c529a_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

ws2_32

advapi32

kernel32

generic