2026-08-04_6e16fb7fff230ff9a6eea60fbfdb1a09_amadey_cobalt-strike_conti_elex_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_6e16fb7fff230ff9a6eea60fbfdb1a09_amadey_cobalt-strike_conti_elex_rhadamanthys_smoke-loader_stop
Size 176KB
Sample260805-a42lmabb68
SHA256 a927a45732d917b171175a4b774bb3aa6618f110a883259faa114bd319df5203
MD5 6e16fb7fff230ff9a6eea60fbfdb1a09
SHA1 632a621c0fbbf51d54f3efd5240e210dac533201
SHA512 c918cfbba647ec361e84e7c39fbdfe7374070d10efc8d86d208e61c88115b2994c74f44ea6aabbda0b6f32d3bc05877754957ab5b2f33e0208f5418072b5420c
SSDEEP 3072:QeO+AxG4R9rNWQcbjUs/BgrrSrrC9rZ9rX9r09ratrUtrtsnesnE:TAx99xAQsZg6qD9akGrsnesnE
TLSH
T179048D932A386023DF438E78A5D8D523AD75F7D29DEE40877126C69D6A843D03B6813E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-04_6e16fb7fff230ff9a6eea60fbfdb1a09_amadey_cobalt-strike_conti_elex_rhadamanthys_smoke-loader_stop

.exe 176KB

2026-08-04_6e16fb7fff230ff9a6eea60fbfdb1a09_amadey_cobalt-strike_conti_elex_rhadamanthys_smoke-loader_stop

IMPHASH 940eae078b7a2480f455376a585b37c5
SHA256 a927a45732d917b171175a4b774bb3aa6618f110a883259faa114bd319df5203
MD5 6e16fb7fff230ff9a6eea60fbfdb1a09
SHA1 632a621c0fbbf51d54f3efd5240e210dac533201
SHA512 c918cfbba647ec361e84e7c39fbdfe7374070d10efc8d86d208e61c88115b2994c74f44ea6aabbda0b6f32d3bc05877754957ab5b2f33e0208f5418072b5420c
SSDEEP 3072:QeO+AxG4R9rNWQcbjUs/BgrrSrrC9rZ9rX9r09ratrUtrtsnesnE:TAx99xAQsZg6qD9akGrsnesnE
TLSH
T179048D932A386023DF438E78A5D8D523AD75F7D29DEE40877126C69D6A843D03B6813E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

8d:71:54:14:e4:91:da:81:ce:a8:75:14:88:8c:6a:96:3c:91:20:80:ed:3f:cd:c6:7c:4d:8f:8e:e5:ff:5f:d3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=SC331902,CN=SimpleHelp Ltd,O=SimpleHelp Ltd,ST=Midlothian,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130853636f746c616e64,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Jul 15, 2026

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Digest

95:83:11:56:62:24:cb:e0:4d:ca:e6:05:72:f0:cf:88:8d:6a:ae:38

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

Jul 15, 2026

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

76:53:fe:b9:3d:d9:e7:e9:26:32:ac:d6:0a:be:ac:38

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2020 - Mar 18, 2045

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

4b:2c:3b:01:01:8b:ad:2a:bc:8c:7b:5b:3e:ed:90:57

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 22, 2021 - Mar 21, 2046

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Globalsign R45 TSA for Authenticode 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:b8:30:0d:fb:a8:75:b3:3b:57:cc:26:37:82

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

Serial Number

88:df:10:3c:59:00:2f:69:0f:44:29:d9:10:54:87:8b

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 15, 2024 - Mar 15, 2027

Minor OS version

Major OS version

Entry point

5400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

rpcrt4

RpcStringBindingComposeW RpcBindingFromStringBindingW RpcBindingSetAuthInfoExW RpcStringFreeW RpcBindingFree I_RpcExceptionFilter NdrClientCall2

kernel32

FlushFileBuffers CloseHandle CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle FreeLibrary GetProcAddress LoadLibraryA HeapAlloc GetProcessHeap HeapFree SetLastError GetCommandLineA GetVersionExA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleA ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetLastError GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind LeaveCriticalSection EnterCriticalSection InitializeCriticalSection Sleep GetCPInfo GetACP GetOEMCP VirtualAlloc HeapReAlloc SetFilePointer GetConsoleCP GetConsoleMode MultiByteToWideChar HeapSize GetLocaleInfoA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_6e16fb7fff230ff9a6eea60fbfdb1a09_amadey_cobalt-strike_conti_elex_rhadamanthys_smoke-loader_stop

rpcrt4

kernel32

generic