General
- Target 2026-08-09_b86ae4a55580caa0ccb1fb8cb3375ef8_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_stealc
- Size 631KB
- Sample260809-lwktpavfng
- SHA256 d2ca476ff0cb274c05970cd637b61c091e7807564d320db6e2a62b0d9ab84f2c
- MD5 b86ae4a55580caa0ccb1fb8cb3375ef8
- SHA1 681c73be0498287425ebe7757ce14bc30d0d09bd
- SHA512 d2adf084ae44f635ee8644ea131f7a9691b7888593b0bbbae28cda8813100b646fe0b25bad7fd73450bdf225ed8c3e74f1e4ac691f90f1f3d0bac3b37828fd4b
- SSDEEP 12288:1EP6CTwNIu2sC3z0o0ARkY1d5PsoRpoyxBlDetAqxSv+ke:OiQw98310ARkCd5vpoybGk
- TLSH T157D4C012B5A09076F07246358969EB559F7D7C704B2097CF63C005EA6E702D0AF3BBAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_b86ae4a55580caa0ccb1fb8cb3375ef8_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_stealc.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-09_b86ae4a55580caa0ccb1fb8cb3375ef8_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_stealc
- Size 631KB
- SHA256 d2ca476ff0cb274c05970cd637b61c091e7807564d320db6e2a62b0d9ab84f2c
- MD5 b86ae4a55580caa0ccb1fb8cb3375ef8
- SHA1 681c73be0498287425ebe7757ce14bc30d0d09bd
- SHA512 d2adf084ae44f635ee8644ea131f7a9691b7888593b0bbbae28cda8813100b646fe0b25bad7fd73450bdf225ed8c3e74f1e4ac691f90f1f3d0bac3b37828fd4b
- SSDEEP 12288:1EP6CTwNIu2sC3z0o0ARkY1d5PsoRpoyxBlDetAqxSv+ke:OiQw98310ARkCd5vpoybGk
- TLSH T157D4C012B5A09076F07246358969EB559F7D7C704B2097CF63C005EA6E702D0AF3BBAB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
2Credentials in Registry
1