2026-08-01_54afaf115f09346e14755a602adc5cb6_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_54afaf115f09346e14755a602adc5cb6_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader
Size 920KB
Sample260801-kbvbys1enh
SHA256 f89baeb587d512c7dc38873b763a93e15af0532a8d3708e5bc6230788614f239
MD5 54afaf115f09346e14755a602adc5cb6
SHA1 abf2e13ff03ad012594799e37abe76103108c93d
SHA512 94b367d3de1000d74f661634a92d35e1dcd3baedd81463c01eca85b2b563aaf0d41871e0d20c8da5619105544460dd87ccb2f83c94ddba005880bfe278a39846
SSDEEP 24576:QRVPH9QJOlMvgOzqr0XvgdGJgNW/hZQbOjxehw:6x9CjgOurzd6QbOFeS
TLSH
T1DA15BF22FAD18072D563143002A66F369DBEBA310921D9CFE7D41A5D5E305E0BB3B7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_54afaf115f09346e14755a602adc5cb6_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

File Explorer

2026-08-01_54afaf115f09346e14755a602adc5cb6_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

.exe 920KB

2026-08-01_54afaf115f09346e14755a602adc5cb6_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

IMPHASH 2b5a33423e61c0462878b2d36c3428c6
SHA256 f89baeb587d512c7dc38873b763a93e15af0532a8d3708e5bc6230788614f239
MD5 54afaf115f09346e14755a602adc5cb6
SHA1 abf2e13ff03ad012594799e37abe76103108c93d
SHA512 94b367d3de1000d74f661634a92d35e1dcd3baedd81463c01eca85b2b563aaf0d41871e0d20c8da5619105544460dd87ccb2f83c94ddba005880bfe278a39846
SSDEEP 24576:QRVPH9QJOlMvgOzqr0XvgdGJgNW/hZQbOjxehw:6x9CjgOurzd6QbOFeS
TLSH
T1DA15BF22FAD18072D563143002A66F369DBEBA310921D9CFE7D41A5D5E305E0BB3B7A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

537972

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\T\ServicesUpdater\Release\ChromeReprompt.pdb

urlmon

URLDownloadToFileW

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW

msi

ord70 ord205

kernel32

GetTempPathA GetLastError Process32NextW K32GetModuleBaseNameW LockResource DeleteFileW Process32FirstW HeapReAlloc CloseHandle LoadLibraryW FindResourceExW LoadResource FindResourceW HeapAlloc K32EnumProcesses DecodePointer HeapDestroy GetWindowsDirectoryW GetProcAddress LocalFree DeleteCriticalSection GetCurrentProcessId GetProcessHeap SystemTimeToFileTime CreateProcessW GetModuleHandleW FreeLibrary CopyFileW WideCharToMultiByte lstrcpyW GetTempFileNameW K32EnumProcessModules GetSystemTime GetExitCodeProcess AreFileApisANSI ReadFile TryEnterCriticalSection HeapCreate EnterCriticalSection GetDiskFreeSpaceW OutputDebugStringA Sleep LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx CreateMutexW GetCurrentThreadId UnmapViewOfFile HeapValidate FormatMessageW GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx DeleteFileA GetSystemInfo HeapCompact UnlockFile LockFileEx GetFileSize GetSystemTimeAsFileTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers lstrlenW GetCommandLineW GetModuleFileNameW lstrcmpW GetTimeZoneInformation ReadConsoleW EnumSystemLocalesW ProcessIdToSessionId MultiByteToWideChar WriteConsoleW CreateToolhelp32Snapshot HeapSize OpenProcess K32GetProcessImageFileNameW GetFileAttributesW CreateFileW WaitForSingleObject InitializeCriticalSectionEx GetTempPathW GetEnvironmentVariableW WriteFile GetCurrentProcess GetFullPathNameW HeapFree SizeofResource FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle LockFile GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleMode EncodePointer LCMapStringEx GetStringTypeW GetCPInfo IsDebuggerPresent RaiseException ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead RtlUnwind SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW SetEnvironmentVariableW ExitProcess GetStdHandle GetFileSizeEx SetFilePointerEx GetFileType GetConsoleOutputCP

advapi32

LookupAccountSidW RegCreateKeyW RegDeleteValueW RegQueryValueExW RegCloseKey CryptAcquireContextW EqualSid RegDeleteKeyW AllocateAndInitializeSid RegCreateKeyExW SetNamedSecurityInfoW GetNamedSecurityInfoW CreateProcessWithTokenW CryptCreateHash CryptHashData RegSetValueExW CryptDestroyHash OpenProcessToken RegOpenKeyExW CreateProcessAsUserW ConvertSidToStringSidW CryptGetHashParam DuplicateTokenEx CryptReleaseContext GetTokenInformation

shell32

CommandLineToArgvW SHGetSpecialFolderPathW SHChangeNotify SHGetFolderPathW SHGetKnownFolderPath

ole32

CoCreateInstance CoUninitialize CoTaskMemFree CoInitialize

Name

.text

Size

663KB

Virtual Size

663KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

124KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

11KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

90KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_54afaf115f09346e14755a602adc5cb6_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

urlmon

wtsapi32

msi

kernel32

advapi32

shell32

ole32

generic