General
- Target 2026-08-16_036bcf5abd212295fe19e7f47a3de0fc_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar
- Size 5.2MB
- Sample260816-sx7headp81
- SHA256 e1a5438e42c7ec9024a3fb2759e74542dab772425ed327dc71dc749756789e0d
- MD5 036bcf5abd212295fe19e7f47a3de0fc
- SHA1 c0d01f3a2927cc79f66efbdd615ff6ed40e73f05
- SHA512 4d70ed4b38705cc9e43168a9b624266d42f85d867fb34528d8b58df2c38a746e9f58d0a76e97c3ca4e5c263d278225c77851570678d754ce4ea2e291c12f7a4a
- SSDEEP 98304:kxQeMjLsAAa/7JNzJwjI5klUigKYkBEvH37ezSC6v2XMHo2:LeGZF6bUpMBIYh2
- TLSH T10746E015F5788337D0B3D0B9C5D2A76AFA323442573089CB4386972C2E277E69A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-16_036bcf5abd212295fe19e7f47a3de0fc_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-16_036bcf5abd212295fe19e7f47a3de0fc_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe
Resource
win11ltsc2024-20260710-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-16_036bcf5abd212295fe19e7f47a3de0fc_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar
- Size 5.2MB
- SHA256 e1a5438e42c7ec9024a3fb2759e74542dab772425ed327dc71dc749756789e0d
- MD5 036bcf5abd212295fe19e7f47a3de0fc
- SHA1 c0d01f3a2927cc79f66efbdd615ff6ed40e73f05
- SHA512 4d70ed4b38705cc9e43168a9b624266d42f85d867fb34528d8b58df2c38a746e9f58d0a76e97c3ca4e5c263d278225c77851570678d754ce4ea2e291c12f7a4a
- SSDEEP 98304:kxQeMjLsAAa/7JNzJwjI5klUigKYkBEvH37ezSC6v2XMHo2:LeGZF6bUpMBIYh2
- TLSH T10746E015F5788337D0B3D0B9C5D2A76AFA323442573089CB4386972C2E277E69A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE