2026-07-31_19e5ebd5ed526cbfcfed12e88622ace5_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-31_19e5ebd5ed526cbfcfed12e88622ace5_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader
Size 776KB
Sample260801-b2pdyscm8x
SHA256 85024eb7a65df0540a47a9b86654592c4a02b0f4e905cdcdcbfa1e45909b100b
MD5 19e5ebd5ed526cbfcfed12e88622ace5
SHA1 21c30af3909b5ba7e5ad2d8af5dcc083105c7739
SHA512 b874c46263da10ba81ffba9745876fdb4a55faf37113df020e3dded76b52f0480c7d296c9acbac615ed50d3c0bde8bb1bdae6e1abd508ba4de6663f4065eb9f8
SSDEEP 12288:p72T0UH9F1iAFvlhec/tqmxt8K0e89C2lwDh2VoH53yi4o4346DWEmtfNMTzBdpw:pqkye/MfmAxWFrooPXEI2Gy
TLSH
T19605D5D06976982DE060CD7C4A98CE9964EF6E3C1B3D34F792B8386C1A7CBD51670D22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-31_19e5ebd5ed526cbfcfed12e88622ace5_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

.exe 776KB

2026-07-31_19e5ebd5ed526cbfcfed12e88622ace5_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

IMPHASH e24f3c9ac7b17a169bdabd77f796c2a4
SHA256 85024eb7a65df0540a47a9b86654592c4a02b0f4e905cdcdcbfa1e45909b100b
MD5 19e5ebd5ed526cbfcfed12e88622ace5
SHA1 21c30af3909b5ba7e5ad2d8af5dcc083105c7739
SHA512 b874c46263da10ba81ffba9745876fdb4a55faf37113df020e3dded76b52f0480c7d296c9acbac615ed50d3c0bde8bb1bdae6e1abd508ba4de6663f4065eb9f8
SSDEEP 12288:p72T0UH9F1iAFvlhec/tqmxt8K0e89C2lwDh2VoH53yi4o4346DWEmtfNMTzBdpw:pqkye/MfmAxWFrooPXEI2Gy
TLSH
T19605D5D06976982DE060CD7C4A98CE9964EF6E3C1B3D34F792B8386C1A7CBD51670D22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

58:e6:01:37:15:32:96:8b:50:89:5f:41:ee:74:1d:63:e3:96:46:c6:f7:d9:e8:41:07:99:83:eb:39:87:b3:9b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=000681038,CN=Bitsum Technologies (Bitsum LLC),O=Bitsum Technologies (Bitsum LLC),L=Morristown,ST=Tennessee,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130954656e6e6573736565,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jul 30, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

08:c1:a2:26:80:ab:e5:ed:39:c3:d6:76:63:fe:27:15

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 12, 2025 - Mar 28, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

290380

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\dev\projs\ProcessSupervisor\output\Insights.pdb

rpcrt4

UuidFromStringW UuidCreate

kernel32

GetLogicalProcessorInformationEx GetActiveProcessorCount DeleteCriticalSection DecodePointer GetLastError InitializeCriticalSectionEx GetCurrentProcess SetPriorityClass FileTimeToLocalFileTime GetFileAttributesW OpenMutexW ReleaseMutex CreateMutexW FileTimeToSystemTime GetActiveProcessorGroupCount WaitForSingleObject CreateThread TerminateThread SetEvent CreateEventW CloseHandle GetLocalTime GetSystemTimeAsFileTime FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy GetModuleHandleW ExitProcess LoadLibraryW WriteConsoleW GetConsoleMode GetConsoleOutputCP SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW CompareStringOrdinal LoadLibraryExW VirtualProtect GetProcAddress LocalFree MultiByteToWideChar WideCharToMultiByte CreateFileW VerifyVersionInfoW VerSetConditionMask FreeLibrary GetUserDefaultUILanguage DeleteFileW GetFileSize ReadFile WriteFile GetVolumeNameForVolumeMountPointW SetLastError OpenEventW GetCurrentProcessId GetStartupInfoW GetModuleFileNameW GlobalAlloc GlobalUnlock GlobalLock WinExec FindClose FindNextFileW FlushFileBuffers GetFileTime SetEndOfFile InitializeCriticalSection ResetEvent Sleep GetCurrentThreadId GetSystemInfo GetTickCount GetVersionExW LocalAlloc LocalLock LocalUnlock MulDiv GetNumaHighestNodeNumber GetNumaNodeProcessorMask IsBadWritePtr K32GetModuleBaseNameW GetDateFormatW GetTimeFormatW SystemTimeToFileTime GetCurrentThread SetThreadPriority SetThreadPriorityBoost GetThreadPriority GetPriorityClass InitializeCriticalSectionAndSpinCount EnterCriticalSection LeaveCriticalSection IsDebuggerPresent OutputDebugStringW RaiseException ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetStringTypeW QueryPerformanceCounter EncodePointer GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent WakeAllConditionVariable SleepConditionVariableSRW InitializeSListHead RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW GetStdHandle GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW SetFilePointerEx

user32

IsWindow SetWindowPos OpenClipboard CloseClipboard SetClipboardData EmptyClipboard IsWindowEnabled EnumChildWindows FindWindowW GetClassNameW SetDlgItemInt GetDlgItemInt TranslateMessage DispatchMessageW PeekMessageW WaitMessage MoveWindow CreateDialogIndirectParamW GetSystemMetrics SetFocus GetActiveWindow GetAsyncKeyState KillTimer GetSystemMenu EnableMenuItem DrawIcon MessageBeep SetRect GetParent GetLastActivePopup GetWindow GetMenuItemInfoW IsDialogMessageW WinHelpW GetMessageW PostMessageW UpdateWindow SetWindowLongW CheckDlgButton LoadImageW GetWindowTextW OffsetRect MessageBoxW LoadStringW DrawTextW GetDialogBaseUnits GetWindowRect GetMenuBarInfo SetDlgItemTextW PostQuitMessage EndPaint BeginPaint DefWindowProcW DestroyWindow CreateWindowExW RegisterClassExW TrackPopupMenu GetCursorPos GetSubMenu SetForegroundWindow FillRect GetClientRect SetTimer SystemParametersInfoW SetMenu LoadMenuW SetWindowTextW LoadIconW LoadBitmapW CheckMenuItem GetMenu ShowWindow GetWindowLongW GetDlgItemTextW SetPropW EndDialog DestroyIcon GetSysColor SendMessageW RedrawWindow DialogBoxParamW IsDlgButtonChecked EnableWindow GetDlgItem

gdi32

SetTextColor CreateDCW GetTextExtentPoint32W SetBkMode CreateFontIndirectW CreateSolidBrush SetBkColor DeleteDC SelectObject DeleteObject

advapi32

RegQueryInfoKeyW RegEnumKeyExW RegEnumValueW RegCreateKeyExW RegDeleteKeyW RegOpenKeyExW RegDeleteValueW RegCloseKey RegQueryValueExW RegSetValueExW

shell32

SHGetSpecialFolderPathW ShellExecuteW SHCreateDirectoryExW

comctl32

ord413 ord17 ord410 InitCommonControlsEx

uxtheme

GetThemeColor SetWindowTheme DrawThemeBackground DrawThemeText CloseThemeData IsThemeActive OpenThemeData

dwmapi

DwmSetWindowAttribute

shlwapi

SHDeleteKeyW

wininet

InternetOpenUrlW InternetCloseHandle InternetOpenW InternetCanonicalizeUrlW InternetReadFile

ole32

StringFromGUID2

Name

.text

Size

410KB

Virtual Size

410KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

91KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

17KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

226KB

Virtual Size

226KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-31_19e5ebd5ed526cbfcfed12e88622ace5_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

rpcrt4

kernel32

user32

gdi32

advapi32

shell32

comctl32

uxtheme

dwmapi

shlwapi

wininet

ole32

generic