2026-07-22_8964a57ff0d34b9d232741269bf38b89_amadey_cobalt-strike_elex_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

General

Target
2026-07-22_8964a57ff0d34b9d232741269bf38b89_amadey_cobalt-strike_elex_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
Size 373KB
Sample260722-x5qbbabd43
SHA256 8994dd64acf29f82f57f3946e5be16485e1a16fd526fb4c359dacca4cba5d436
MD5 8964a57ff0d34b9d232741269bf38b89
SHA1 e846edc917e1ccc842bb951d66278bf62ad4994c
SHA512 5ffedc21591cc2e20459f4125b085abe9ffdaac0f1de62faa2c4508f6ed409b8edf89f618a5a9e8cd1536c6afee1e17a8e86779e5b30de421b812f2df0b04a57
SSDEEP 3072:vPMZbVw3mkRqer5+ncloOZ4FoVj5lhKrMzkm8PL3E7Qw/STyr5Jks7Mj:vg5Sqer5+nDFohbzkmIL3E7QPQLk
TLSH
T10884060D765F95E2DB614E3C5828C2A0C636FD63E95069277AC4330BCD322E78E26B35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_8964a57ff0d34b9d232741269bf38b89_amadey_cobalt-strike_elex_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-07-22_8964a57ff0d34b9d232741269bf38b89_amadey_cobalt-strike_elex_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

.exe 373KB

2026-07-22_8964a57ff0d34b9d232741269bf38b89_amadey_cobalt-strike_elex_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 0ab8af968841351a6340b418cb8a364d
SHA256 8994dd64acf29f82f57f3946e5be16485e1a16fd526fb4c359dacca4cba5d436
MD5 8964a57ff0d34b9d232741269bf38b89
SHA1 e846edc917e1ccc842bb951d66278bf62ad4994c
SHA512 5ffedc21591cc2e20459f4125b085abe9ffdaac0f1de62faa2c4508f6ed409b8edf89f618a5a9e8cd1536c6afee1e17a8e86779e5b30de421b812f2df0b04a57
SSDEEP 3072:vPMZbVw3mkRqer5+ncloOZ4FoVj5lhKrMzkm8PL3E7Qw/STyr5Jks7Mj:vg5Sqer5+nDFohbzkmIL3E7QPQLk
TLSH
T10884060D765F95E2DB614E3C5828C2A0C636FD63E95069277AC4330BCD322E78E26B35
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

RegisterClassExA TranslateMessage PostQuitMessage LoadIconA LoadCursorA GetMessageA DispatchMessageA DefWindowProcA SendMessageA CreateWindowExA CharLowerA

kernel32

lstrlenA lstrcpyA lstrcmpiA BeginUpdateResourceA CloseHandle CopyFileA CreateFileA CreateFileMappingA CreateThread DeleteFileA EndUpdateResourceA EnumResourceNamesA ExitProcess FindClose FindFirstFileA FindNextFileA FindResourceA FreeLibrary GetCommandLineA GetDriveTypeA GetEnvironmentVariableA GetFileAttributesA GetFileSize GetModuleFileNameA GetModuleHandleA GetShortPathNameA GetSystemDefaultLangID GetTickCount GetWindowsDirectoryA GlobalAlloc GlobalFree LoadLibraryA LoadResource LockResource MapViewOfFile MoveFileA ReadFile RtlMoveMemory SetEndOfFile SetFilePointer SizeofResource Sleep UnmapViewOfFile UpdateResourceA WinExec WriteFile lstrcatA lstrcmpA

shlwapi

PathFindExtensionA

urlmon

URLDownloadToFileA

advapi32

RegCreateKeyA RegSetValueExA RegQueryValueExA RegOpenKeyExA RegCloseKey

shell32

ShellExecuteA

dbghelp

MakeSureDirectoryPathExists

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_8964a57ff0d34b9d232741269bf38b89_amadey_cobalt-strike_elex_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

user32

kernel32

shlwapi

urlmon

advapi32

shell32

dbghelp

generic