2026-08-13_79c35b010a1fbff19558f5f5c9e526f1_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-13_79c35b010a1fbff19558f5f5c9e526f1_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader
Size 675KB
Sample260813-e6f5xsgg77
SHA256 8acc56850d544252cec64f94ea56493f6896f8cceb62e9290beb355cac3c2a68
MD5 79c35b010a1fbff19558f5f5c9e526f1
SHA1 043a7a07eb3c8546a61914ce730660c1d93d75d0
SHA512 8a32268f8f6cdd34ddbe04510c297f15d4e9317e2d1f48c68c84fd2013ac111a59d1c1427f584d449cba93e37a238dad60c187e42db26bbeaa5345c64ddfeee0
SSDEEP 12288:NLSxrQ8GHVcQM87AxndCSSXq8cyKZpNX8o:UFQ89vxxdCSyKZpNj
TLSH
T13BE46C10A951807AECB701718FBECA7A952D6821077014E777D81D2FBF67AD07A3236B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-13_79c35b010a1fbff19558f5f5c9e526f1_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

.exe 675KB

2026-08-13_79c35b010a1fbff19558f5f5c9e526f1_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

IMPHASH 9576473755065b4aec43bac4b89d8e2b
SHA256 8acc56850d544252cec64f94ea56493f6896f8cceb62e9290beb355cac3c2a68
MD5 79c35b010a1fbff19558f5f5c9e526f1
SHA1 043a7a07eb3c8546a61914ce730660c1d93d75d0
SHA512 8a32268f8f6cdd34ddbe04510c297f15d4e9317e2d1f48c68c84fd2013ac111a59d1c1427f584d449cba93e37a238dad60c187e42db26bbeaa5345c64ddfeee0
SSDEEP 12288:NLSxrQ8GHVcQM87AxndCSSXq8cyKZpNX8o:UFQ89vxxdCSyKZpNj
TLSH
T13BE46C10A951807AECB701718FBECA7A952D6821077014E777D81D2FBF67AD07A3236B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

3d:bc:f9:c3:23:e9:5a:f0:18:e3:46:98:04:40:20:86:3e:05:ab:64:4c:c7:20:2e:b0:d0:52:23:b1:e4:38:0b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Yanting Bai,O=Yanting Bai,L=Wafangdian,ST=Liaoning,C=CN

Chains

Jun 19, 2026

CN=Yanting Bai,O=Yanting Bai,L=Wafangdian,ST=Liaoning,C=CN

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Yanting Bai,O=Yanting Bai,L=Wafangdian,ST=Liaoning,C=CN

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Digest

20:03:6f:32:17:cd:36:09:1b:9b:5d:46:31:46:5d:9a:d5:4d:d6:b2

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Yanting Bai,O=Yanting Bai,L=Wafangdian,ST=Liaoning,C=CN

Chains

Jun 19, 2026

CN=Yanting Bai,O=Yanting Bai,L=Wafangdian,ST=Liaoning,C=CN

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Yanting Bai,O=Yanting Bai,L=Wafangdian,ST=Liaoning,C=CN

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

21:d6:d0:4a:4f:25:0f:c9:32:37:fc:aa:5e:12:8d:e9

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Oct 6, 2011 - Oct 6, 2046

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Yanting Bai,O=Yanting Bai,L=Wafangdian,ST=Liaoning,C=CN

Serial Number

02:92:c9:7d:df:01:23:6a:68:8a:19:4c:c7:9a:ee:f9

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 12, 2026 - May 12, 2027

Subject

CN=Certum Timestamp 2026,O=Asseco Data Systems S.A.,C=PL

Serial Number

28:f0:77:c1:1c:36:bd:fe:5f:74:32:47:70:27:2e:03

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 11, 2026 - Feb 27, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 31, 2021 - Sep 17, 2029

Minor OS version

Major OS version

Entry point

174729

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\weasel\output\Win32\WeaselDeployer.pdb

rime

rime_get_api

kernel32

FindResourceExW GetThreadUILanguage SetLastError EnterCriticalSection LeaveCriticalSection GetCurrentThreadId DeleteCriticalSection InitializeCriticalSectionEx OutputDebugStringW CreateDirectoryW DecodePointer GetSystemWow64DirectoryW ExitProcess WaitForSingleObject FreeLibrary GetProcAddress GetModuleHandleW lstrcmpiW LoadLibraryExW SetThreadUILanguage SetThreadLocale GetCommandLineA GetOEMCP GetACP FindResourceW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetConsoleMode GetConsoleOutputCP GetFileSizeEx GetFileType GetStdHandle VirtualQuery CreateMutexW GetSystemInfo TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy IsValidCodePage CloseHandle GetFileAttributesW GetUserDefaultUILanguage GetLastError WideCharToMultiByte MultiByteToWideChar RaiseException SizeofResource LockResource LoadResource GetModuleFileNameW ExpandEnvironmentStringsW RtlUnwind GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW ResetEvent WaitForSingleObjectEx TerminateProcess WriteConsoleW ReadConsoleW SetStdHandle FreeEnvironmentStringsW SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo LCMapStringEx GetCommandLineW GetStringTypeW GetFileInformationByHandleEx AreFileApisANSI SetFilePointerEx SetEndOfFile GetEnvironmentStringsW VirtualProtect CreateEventW FormatMessageA LocalFree SetEvent GetModuleHandleExW WaitNamedPipeW SetNamedPipeHandleState CreateFileW WriteFile FlushFileBuffers DisconnectNamedPipe ReadFile IsDebuggerPresent EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList GetCurrentProcess FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW

user32

MapWindowPoints GetClientRect GetParent GetWindowRect EnableWindow MonitorFromWindow GetWindowLongW GetWindow BringWindowToTop GetDlgItem SetWindowLongW DialogBoxParamW SetWindowPos UnregisterClassW MessageBoxExW GetActiveWindow GetMonitorInfoW SendMessageW MessageBoxW LoadStringW DestroyWindow CharNextW GetKeyState CallWindowProcW DefWindowProcW SetWindowTextW EndDialog

gdi32

GetObjectW CreateCompatibleDC SetDIBColorTable SelectObject DeleteObject DeleteDC CreateDIBSection

advapi32

RegEnumKeyExW GetUserNameW RegQueryValueExW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegOpenKeyW RegQueryInfoKeyW RegDeleteKeyW RegGetValueW RegCloseKey

shell32

ShellExecuteExW ord155 SHOpenFolderAndSelectItems ord190

ole32

CoInitializeEx CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoCreateInstance CoInitialize CoUninitialize

oleaut32

VarUI4FromStr

gdiplus

GdiplusShutdown GdipDrawImageI GdipDeleteGraphics GdipDisposeImage GdipFree GdipAlloc GdipCloneImage GdipCreateBitmapFromScan0 GdipBitmapUnlockBits GdipBitmapLockBits GdipGetImagePalette GdipGetImagePaletteSize GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat GdipCreateBitmapFromFile GdipCreateBitmapFromFileICM GdiplusStartup GdipGetImageGraphicsContext

comctl32

InitCommonControlsEx

??0?$codecvt_null@_W@archive@boost@@QAE@I@Z ??0?$singleton@V?$extended_type_info_typeid@UCandidateInfo@weasel@@@serialization@boost@@@serialization@boost@@IAE@XZ ??0?$singleton@V?$extended_type_info_typeid@UText@weasel@@@serialization@boost@@@serialization@boost@@IAE@XZ ??0?$singleton@V?$extended_type_info_typeid@UTextAttribute@weasel@@@serialization@boost@@@serialization@boost@@IAE@XZ ??0?$singleton@V?$extended_type_info_typeid@UTextRange@weasel@@@serialization@boost@@@serialization@boost@@IAE@XZ ??0?$singleton@V?$extended_type_info_typeid@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@serialization@boost@@@serialization@boost@@IAE@XZ ??0?$singleton@V?$extended_type_info_typeid@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@serialization@boost@@@serialization@boost@@IAE@XZ ??1?$codecvt_null@_W@archive@boost@@UAE@XZ ??_F?$codecvt_null@_W@archive@boost@@QAEXXZ ?do_always_noconv@?$codecvt_null@_W@archive@boost@@EBE_NXZ ?do_encoding@?$codecvt_null@_W@archive@boost@@EBEHXZ ?do_in@?$codecvt_null@_W@archive@boost@@EBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z ?do_max_length@?$codecvt_null@_W@archive@boost@@EBEHXZ ?do_out@?$codecvt_null@_W@archive@boost@@EBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z ?get_const_instance@?$singleton@V?$extended_type_info_typeid@UCandidateInfo@weasel@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UCandidateInfo@weasel@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@UText@weasel@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UText@weasel@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@UTextAttribute@weasel@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UTextAttribute@weasel@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@UTextRange@weasel@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UTextRange@weasel@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@23@XZ ?get_const_instance@?$singleton@V?$iserializer@Vtext_wiarchive@archive@boost@@UCandidateInfo@weasel@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_wiarchive@archive@boost@@UCandidateInfo@weasel@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vtext_wiarchive@archive@boost@@UText@weasel@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_wiarchive@archive@boost@@UText@weasel@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vtext_wiarchive@archive@boost@@UTextAttribute@weasel@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_wiarchive@archive@boost@@UTextAttribute@weasel@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vtext_wiarchive@archive@boost@@UTextRange@weasel@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_wiarchive@archive@boost@@UTextRange@weasel@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vtext_wiarchive@archive@boost@@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_wiarchive@archive@boost@@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vtext_wiarchive@archive@boost@@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_wiarchive@archive@boost@@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$map@Vtext_wiarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vtext_wiarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?get_lock@singleton_module@serialization@boost@@AAEAA_NXZ ?get_mutable_instance@?$singleton@V?$map@Vtext_wiarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vtext_wiarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?is_destroyed@?$singleton@V?$map@Vtext_wiarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?is_locked@singleton_module@serialization@boost@@QAE_NXZ ?load_object_data@?$iserializer@Vtext_wiarchive@archive@boost@@UCandidateInfo@weasel@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?load_object_data@?$iserializer@Vtext_wiarchive@archive@boost@@UText@weasel@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?load_object_data@?$iserializer@Vtext_wiarchive@archive@boost@@UTextAttribute@weasel@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?load_object_data@?$iserializer@Vtext_wiarchive@archive@boost@@UTextRange@weasel@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?load_object_data@?$iserializer@Vtext_wiarchive@archive@boost@@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?load_object_data@?$iserializer@Vtext_wiarchive@archive@boost@@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?lock@?1??get_lock@singleton_module@serialization@boost@@AAEAA_NXZ@4_NA ?lock@singleton_module@serialization@boost@@QAEXXZ ?unlock@singleton_module@serialization@boost@@QAEXXZ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-13_79c35b010a1fbff19558f5f5c9e526f1_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

rime

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

gdiplus

comctl32

generic