2026-08-21_aa03c2a5c57f4e0545dfa289c708fc34_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_redline-stealer_rhadamanthys_stop

General

Target
2026-08-21_aa03c2a5c57f4e0545dfa289c708fc34_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_redline-stealer_rhadamanthys_stop
Size 517KB
Sample260822-ka8sysfp71
SHA256 ec82606cc3cca11385d0896bf8b5e7a55c5b7fa8a1e0e11b7b61d2130bef52af
MD5 aa03c2a5c57f4e0545dfa289c708fc34
SHA1 1c298089ef8da4ec22bc2fff353ea55cfe099889
SHA512 b4d3314e40f999cc86ee9f359839a8b5ce16bc46771b7c396864e9502c931e776e97a982a42c8ce8a1af65269f16e77592af16884c937c232734e39e7faac140
SSDEEP 12288:I5ccz1/IIIgEw2ZLZAuo/afPHyGVq++45Flx+eWC:8PB/I9Auo/cvCmFlB
TLSH
T1DFB49E10BC91C033C6733871477AE9765D7D68301A319ACF63C80A796F749D1AA3AA6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-21_aa03c2a5c57f4e0545dfa289c708fc34_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_redline-stealer_rhadamanthys_stop

File Explorer

2026-08-21_aa03c2a5c57f4e0545dfa289c708fc34_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_redline-stealer_rhadamanthys_stop

.exe 517KB

2026-08-21_aa03c2a5c57f4e0545dfa289c708fc34_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_redline-stealer_rhadamanthys_stop

IMPHASH ba2c974ed567c90fe365844af978f320
SHA256 ec82606cc3cca11385d0896bf8b5e7a55c5b7fa8a1e0e11b7b61d2130bef52af
MD5 aa03c2a5c57f4e0545dfa289c708fc34
SHA1 1c298089ef8da4ec22bc2fff353ea55cfe099889
SHA512 b4d3314e40f999cc86ee9f359839a8b5ce16bc46771b7c396864e9502c931e776e97a982a42c8ce8a1af65269f16e77592af16884c937c232734e39e7faac140
SSDEEP 12288:I5ccz1/IIIgEw2ZLZAuo/afPHyGVq++45Flx+eWC:8PB/I9Auo/cvCmFlB
TLSH
T1DFB49E10BC91C033C6733871477AE9765D7D68301A319ACF63C80A796F749D1AA3AA6F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

9747

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GenerateConsoleCtrlEvent GetExitCodeProcess WaitForSingleObject CreateProcessA SetConsoleCtrlHandler GetModuleFileNameA EnterCriticalSection LeaveCriticalSection GetModuleHandleW Sleep GetProcAddress ExitProcess GetCommandLineA GetStartupInfoA SetHandleCount GetStdHandle GetFileType DeleteCriticalSection TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetLastError HeapFree HeapAlloc GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId WriteFile LoadLibraryA InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind HeapReAlloc VirtualAlloc GetConsoleCP GetConsoleMode FlushFileBuffers LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetFilePointer HeapSize CloseHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA CompareStringA CompareStringW SetEnvironmentVariableA ReadFile SetEndOfFile GetProcessHeap GetFileAttributesA

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-21_aa03c2a5c57f4e0545dfa289c708fc34_amadey_cobalt-strike_coinminer_elex_luca-stealer_njrat_redline-stealer_rhadamanthys_stop

kernel32

generic