General
- Target 2026-08-19_395015f9e214f24554ee795bec6b3654_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar
- Size 7.0MB
- Sample260819-21z26sysc1
- SHA256 49a816cf80f8952020a4e7a237f673aa0d7f8fce6022cf098e6efda5cb8bd2d9
- MD5 395015f9e214f24554ee795bec6b3654
- SHA1 c369031f72fba230e93d13bd5e69109b91729531
- SHA512 df7fd0d5ce1b39e1c1f49edfbc3cfa2da151baec5b9dfd242e09de00a759498a4319a46aa7e5d9fa7462eb25e7cc6d71e48d5a711f18e03e4302f11b1e9e5feb
- SSDEEP 98304:kxQeMjLsAAa/7JNzJwjI5klUigKYkBEvH37ezSC6v2XMHoCE2YFGOCezSC6v2XMh:LeGZF6bUpMBIYhb72
- TLSH T18A76BF15F6788337D0B3D1BAC5D2A66AFA3234461B3089CB0346876D2E376E6C636735
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_395015f9e214f24554ee795bec6b3654_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_395015f9e214f24554ee795bec6b3654_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-19_395015f9e214f24554ee795bec6b3654_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar
- Size 7.0MB
- SHA256 49a816cf80f8952020a4e7a237f673aa0d7f8fce6022cf098e6efda5cb8bd2d9
- MD5 395015f9e214f24554ee795bec6b3654
- SHA1 c369031f72fba230e93d13bd5e69109b91729531
- SHA512 df7fd0d5ce1b39e1c1f49edfbc3cfa2da151baec5b9dfd242e09de00a759498a4319a46aa7e5d9fa7462eb25e7cc6d71e48d5a711f18e03e4302f11b1e9e5feb
- SSDEEP 98304:kxQeMjLsAAa/7JNzJwjI5klUigKYkBEvH37ezSC6v2XMHoCE2YFGOCezSC6v2XMh:LeGZF6bUpMBIYhb72
- TLSH T18A76BF15F6788337D0B3D1BAC5D2A66AFA3234461B3089CB0346876D2E376E6C636735
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Drops file in System32 directory