fcb03c78207dfb86e599e907016deb734ad674a9ae9628b8f17db1d5ea9a9951

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 21:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_d32b98c381e18e248b8f12f271ba66e9_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
Size 333KB
Sample260810-1kntjayhnd
SHA256 fcb03c78207dfb86e599e907016deb734ad674a9ae9628b8f17db1d5ea9a9951
MD5 d32b98c381e18e248b8f12f271ba66e9
SHA1 1863c2b1476ce9b554a957839cf203a703ede6f1
SHA512 717d1e6889c86f922e0b85a05378da73cb172dd8e18c6b926f573624586b6e90eaa3303e2d31b27c9f63f4aa7223891d1e8641254f99e542dc0e9a0c70c18024
SSDEEP 6144:WdVfjmNHWl5tfsXY4hrU/Mm79iDSM/gDExD65DDlJAz8AOb3URXEk:+7+HI2trmMm79iDSqgQOJURXEk
TLSH
T154749E907691C072D9B215325E68DBB6493EBD114F2545EB73C81A7ECE303C2EB31B6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4752	Logo1_.exe
2744	2026-08-10_d32b98c381e18e248b8f12f271ba66e9_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\include\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fr-fr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\eu\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\WidevineCdm\_platform_specific\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\WidevineCdm\_platform_specific\win_x64\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\ext\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\km-KH\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Microsoft.Xbox.SmartGlass.Controls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x86__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\Simple\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\si\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\data\en-us\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Views\Utilities\Styling\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\eu-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\es-es\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	2026-08-10_d32b98c381e18e248b8f12f271ba66e9_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	2026-08-10_d32b98c381e18e248b8f12f271ba66e9_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4824	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_d32b98c381e18e248b8f12f271ba66e9_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4752	Logo1_.exe
4752	Logo1_.exe
4752	Logo1_.exe
4752	Logo1_.exe
4752	Logo1_.exe
4752	Logo1_.exe
4752	Logo1_.exe
4752	Logo1_.exe
4752	Logo1_.exe
4752	Logo1_.exe
4752	Logo1_.exe
4752	Logo1_.exe
4752	Logo1_.exe
4752	Logo1_.exe
4752	Logo1_.exe
4752	Logo1_.exe
4752	Logo1_.exe
4752	Logo1_.exe
4752	Logo1_.exe
4752	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 4824	4292	2026-08-10_d32b98c381e18e248b8f12f271ba66e9_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe	87
PID 4292 wrote to memory of 4752	4292	2026-08-10_d32b98c381e18e248b8f12f271ba66e9_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe	88
PID 4752 wrote to memory of 4332	4752	Logo1_.exe	90
PID 4332 wrote to memory of 4960	4332	net.exe	92
PID 4824 wrote to memory of 2744	4824	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-08-10_d32b98c381e18e248b8f12f271ba66e9_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_d32b98c381e18e248b8f12f271ba66e9_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F05.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Users\Admin\AppData\Local\Temp\2026-08-10_d32b98c381e18e248b8f12f271ba66e9_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_d32b98c381e18e248b8f12f271ba66e9_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe"
    3⤵
    - Executes dropped EXE
    PID:2744
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4332
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 1b97503920be6acb1cff4e9b39dfc612e819ae6e5eea3a59537d894214935edf
MD5 c75db9a2975af44b314b4e378bb3bebf
SHA1 fe83b8cd23b11e54e4f213ee1eef398e0da807bd
SHA512 bfc60fe549be48448cd3ac620a6d5f50d04e8d27583d63bdd1b38efd8d0ab43382118f6225ac12c3c7a0c77dd7843505c949ba7ac143313544082f896adb410c
SSDEEP 3072:GNftffjmNqYCkuRieOVETT+jYPnau3fVGAhoRqzB+NkGHS2:GdVfjmNqYCk3ET+Tu3fC0zB+JHv
TLSH
T1EEC39D1335D08472E4B2593109A1EDB18A3EFD620950DE7B33D52B3E0F316D1DE2AA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 575KB
SHA256 ec3fb836bbb80087df07db21c9b20e96e164ab0937bfb4631f28f587cff86bfb
MD5 cea0b3cb174200eeab9268e6d3e19e78
SHA1 29f0109987cf7968575cc103366f03d5ad6f376d
SHA512 2c79b74a0d76da3b0a3401795f94bef30003caf35d779c51d34f99266b800ccec5feff848d8d50e40b1870fd0dffdbc34551c7362a99d4ee29036ad3a182ba81
SSDEEP 12288:+7+7XZNYVLeyUji0h90ZD0wxpGZIVuKrHs:+7o0Le5ji0hmxNrM
TLSH
T1E4C40916F6748335D073C0B9C5D2A68EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a4F05.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a4F05.bat
Size 944B
SHA256 9fb941ec042fc110efbb71f9e7b2e3a1f803a74b213eccbb5e056526dca193cc
MD5 eed481edaed7a35e45b206e17c50d751
SHA1 db94d2632c85dbfda8623e2adff55949f756a7d3
SHA512 aa19f5f9f7d764771e8e93166c0afb9e7c94234cf39cf7b0a5e4196ed62cffa1d6d42a0d491c10480c19d9a3d45b86a2551d8572f17304324d35f2463ca55b19
TLSH
T19D11822F879FCF190EA6F41B42E72CDBC651AA4A264E2B117380C21D54E194DE6E3746
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-10_d32b98c381e18e248b8f12f271ba66e9_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-10_d32b98c381e18e248b8f12f271ba66e9_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe.exe
Size 307KB
SHA256 affd87f344207744e4c43215d29add1a6ccf4eaa6a17591654d14cfa164b8b0c
MD5 175968b17779fb17e8235d3d6a5e523e
SHA1 1fd4db82e026c971733350107d7cf52656aa542c
SHA512 b53222aaff7922674c7e59bcf6d172b1518e6c7e69e23337d5c8376dd5df6ad18677da5ff2a5d8b455d17e90576edb04275359f6200ba61d7c92bfefc5682522
SSDEEP 6144:zWl5tfsXY4hrU/Mm79iDSM/gDExD65DDlJAz8AOb3URXEk:zI2trmMm79iDSqgQOJURXEk
TLSH
T107649F90B691C472D9B315321E68DBB6493DB9514F2495DB73C80A7ECE303C2EB31B6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 047f0e5cd405822a0e53adfa3d29cc56914d67f6cf3a80cf95792306068555c8
MD5 6442b83cec12263de4226b8f395748df
SHA1 7be431f51fd0995684575a8b2208a9ad7d0decd8
SHA512 0f947deda93f1de12feee1d7e2d1c4f884be80f07f02244aac05edf92ee4279a797e1fde63a116235b3b1aa7198fe325fb652df231e4527c69b269954fa60cd7
SSDEEP 768:Wf1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:WNfgLdQAQfcfymN
TLSH
T109C2D07A26C83578D825497CDBD35781833D0E7A085F596726F1BA7F2270B64100FA67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-1788976790-1541110888-1636651838-1000\_desktop.ini
Size 9B
SHA256 a6a30469b07b10cfc3228a527f800194638f4d6c88b814a540b333c9371056f8
MD5 809f47ced3507b857f0be4647cd218fe
SHA1 fbdf780581ab4fd33bf33b14c662c16ca9d056c5
SHA512 2705955b3b04d3e8bff5203d6797609799bd979a883244e0f5528b588b34efa751c9703151715153c72a073f037fb47da4ace7dc7bf30f8f418e4d375f8d8fd7
MD5 SHA1 SHA512

Submit Download

memory/4292-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4292-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4752-27-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4752-37-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4752-33-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4752-357-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4752-1246-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4752-20-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4752-5035-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4752-8-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4752-5538-0x0000000000400000-0x0000000000434000-memory.dmp

Download