2026-08-27_8cbcd0adfe26b41f1137fae63ae8b58d_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-27_8cbcd0adfe26b41f1137fae63ae8b58d_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader
Size 479KB
Sample260827-qcxflatxfv
SHA256 cf39664dcd646de9b8eb3f8c5ff9d93c2a5d17c501c115cb7755bbb0985b9452
MD5 8cbcd0adfe26b41f1137fae63ae8b58d
SHA1 e16e3411fdd91be2f48fb4ea38a47bd6729ccbc7
SHA512 b96c72fffee62cb9824dfd3e2eb44d72a0d9a94fb40215ccc3f19d167ec6a5d47f2bfb99bb2697a2a4b9d02b1116428c6dbe3271c150bb03257e162c4bf830e5
SSDEEP 6144:x50IqasNrhWXtV1crz9M3bCQTLlR3ZKSpier8UqJ+wicaAOoV50DErsE0RjpJ3As:x35shk8z9w5TLHZhsJgrRD3Dp
TLSH
T1B3A49E01E3C15131C5E315B2172E97F6933AA07803A997FBA7D88AED68125D09377BE3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-27_8cbcd0adfe26b41f1137fae63ae8b58d_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

File Explorer

2026-08-27_8cbcd0adfe26b41f1137fae63ae8b58d_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

.exe 479KB

2026-08-27_8cbcd0adfe26b41f1137fae63ae8b58d_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

IMPHASH 0a9408c6faeb695bd707f9f7bc6240a7
SHA256 cf39664dcd646de9b8eb3f8c5ff9d93c2a5d17c501c115cb7755bbb0985b9452
MD5 8cbcd0adfe26b41f1137fae63ae8b58d
SHA1 e16e3411fdd91be2f48fb4ea38a47bd6729ccbc7
SHA512 b96c72fffee62cb9824dfd3e2eb44d72a0d9a94fb40215ccc3f19d167ec6a5d47f2bfb99bb2697a2a4b9d02b1116428c6dbe3271c150bb03257e162c4bf830e5
SSDEEP 6144:x50IqasNrhWXtV1crz9M3bCQTLlR3ZKSpier8UqJ+wicaAOoV50DErsE0RjpJ3As:x35shk8z9w5TLHZhsJgrRD3Dp
TLSH
T1B3A49E01E3C15131C5E315B2172E97F6933AA07803A997FBA7D88AED68125D09377BE3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

160498

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\artem\source\repos\TestNtfsSearch2 (for sale)\Release\Stub.pdb

iphlpapi

GetIpNetTable

ntdll

RtlInitUnicodeString NtClose NtCreateFile RtlUnwind

kernel32

LoadResource LockResource lstrlenW GetProcAddress GetModuleHandleW GetModuleHandleA GetLastError ExitProcess SetErrorMode GetConsoleWindow WaitForMultipleObjects GetWindowsDirectoryA lstrcatA CreateFileA lstrlenA OpenMutexA CreateMutexA GetSystemInfo GetVolumeInformationW VirtualAlloc UnmapViewOfFile GetFileAttributesW LocalFree FindFirstFileW FindNextFileW FindClose GetDriveTypeW GetWindowsDirectoryW GetSystemTime GetLogicalDriveStringsW LocalAlloc VirtualProtect GetCurrentThreadId GetVolumePathNameW GlobalLock GlobalUnlock MulDiv SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage SetFilePointerEx FindResourceW GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetFileType GetCommandLineW GetCommandLineA GetStdHandle GetModuleFileNameW GetModuleHandleExW FreeLibraryAndExitThread LoadLibraryExW WriteFile GetLocalTime CreateFileW DeleteCriticalSection InitializeCriticalSection DeleteTimerQueue CancelIo CreateTimerQueueTimer GetQueuedCompletionStatus CreateTimerQueue PostQueuedCompletionStatus CreateIoCompletionPort GlobalFree GlobalAlloc ResumeThread lstrcpyW GetDiskFreeSpaceW ExitThread Sleep LeaveCriticalSection EnterCriticalSection Process32NextW Process32FirstW CreateToolhelp32Snapshot lstrcmpW GetCurrentProcess OpenProcess HeapReAlloc CloseHandle WaitForSingleObject CreateThread HeapFree GetProcessHeap HeapAlloc FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc SetLastError RaiseException TerminateProcess InitializeSListHead GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent CreateEventW InitializeCriticalSectionAndSpinCount GetCPInfo GetStringTypeW GetSystemTimeAsFileTime HeapSize WriteConsoleW SizeofResource FindFirstFileExW MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter EncodePointer DecodePointer InitializeCriticalSectionEx LCMapStringEx FlsAlloc FlsGetValue FlsSetValue FlsFree

user32

SystemParametersInfoW GetShellWindow GetWindowThreadProcessId GetWindowTextLengthW EndDialog GetClientRect wsprintfA GetDC wsprintfW SendMessageW CreateWindowExW SetWindowPos OpenClipboard ShowWindow DrawTextA ReleaseDC EmptyClipboard DispatchMessageW TranslateMessage GetMessageW RegisterHotKey MessageBoxW GetWindowRect GetSystemMetrics RegisterClassExW LoadCursorW DefWindowProcW PostQuitMessage CloseClipboard SetClipboardData

gdi32

CreateCompatibleDC GetStockObject GetDeviceCaps DeleteObject DeleteDC BitBlt CreateDIBSection SetBkColor SetBkMode SetTextColor CreateCompatibleBitmap GetTextExtentPoint32A SelectObject CreateFontW

advapi32

SetEntriesInAclW RevertToSelf AllocateAndInitializeSid OpenProcessToken GetTokenInformation DuplicateTokenEx RegOpenKeyExW SystemFunction036 SetNamedSecurityInfoW AdjustTokenPrivileges LookupPrivilegeValueW DuplicateToken AccessCheck GetNamedSecurityInfoW RegQueryValueExA RegSetValueExA RegCloseKey RegSetValueExW SetThreadToken

shell32

SHBrowseForFolderW ShellExecuteExA SHEmptyRecycleBinA SHGetPathFromIDListW

ole32

CoSetProxyBlanket CoCreateInstance

oleaut32

SysAllocString SysFreeString VariantClear VariantInit

ws2_32

WSACleanup WSAStartup shutdown gethostname gethostbyname WSASocketW WSAIoctl closesocket inet_ntoa WSAGetLastError WSAAddressToStringW bind htons setsockopt getsockopt

netapi32

NetApiBufferFree NetShareEnum

shlwapi

StrStrIA

mpr

WNetCloseEnum WNetEnumResourceW WNetOpenEnumW

crypt32

CryptBinaryToStringA CryptStringToBinaryA

comctl32

ord17 InitCommonControlsEx

Name

.text

Size

262KB

Virtual Size

262KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

196KB

Virtual Size

195KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-27_8cbcd0adfe26b41f1137fae63ae8b58d_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

iphlpapi

ntdll

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

ws2_32

netapi32

shlwapi

mpr

crypt32

comctl32

generic