General
- Target 2026-08-09_5edc692a91a3eca803bebe5afa11bde5_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_stealc
- Size 631KB
- Sample260809-ykb4mavcrb
- SHA256 7e9edf7a77d11ff29677dd2d1af644930b7b5f8c8632b4fd393d06c0e48149b3
- MD5 5edc692a91a3eca803bebe5afa11bde5
- SHA1 d77cfe466afe02786525c5fe765198917c165c9f
- SHA512 8e3f3ea9a0e4d76f555aca0abd975931f31bc728a5b539301f45f907756fed479664a5797b365d8d4ddc2726c42bbc9e9121da6764747245e0264356579b1a5a
- SSDEEP 12288:MEP6CTwNIu2sC3z0o0ARkV9lVbsQNoyxBlDetAqxSv+ke:fiQw98310ARkblVrNoybGk
- TLSH T159D4C012B5A09076F07246358969EB559F7D7C700B2097CF63C405EA6E702D0AF3BBAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_5edc692a91a3eca803bebe5afa11bde5_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_stealc.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-09_5edc692a91a3eca803bebe5afa11bde5_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_stealc
- Size 631KB
- SHA256 7e9edf7a77d11ff29677dd2d1af644930b7b5f8c8632b4fd393d06c0e48149b3
- MD5 5edc692a91a3eca803bebe5afa11bde5
- SHA1 d77cfe466afe02786525c5fe765198917c165c9f
- SHA512 8e3f3ea9a0e4d76f555aca0abd975931f31bc728a5b539301f45f907756fed479664a5797b365d8d4ddc2726c42bbc9e9121da6764747245e0264356579b1a5a
- SSDEEP 12288:MEP6CTwNIu2sC3z0o0ARkV9lVbsQNoyxBlDetAqxSv+ke:fiQw98310ARkblVrNoybGk
- TLSH T159D4C012B5A09076F07246358969EB559F7D7C700B2097CF63C405EA6E702D0AF3BBAB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Deletes itself
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
2Credentials in Registry
1