General
- Target 2026-09-09_81e6644cd34a0f4f403d65c1c0b83873_amadey_cloudeye_cobalt-strike_elex_hijackloader_nymaim_rhadamanthys_smoke-loader_vidar
- Size 1.1MB
- Sample260909-va8s3ayble
- SHA256 9d55c6dd402f4ab54c896c6c52960e52d0c654bf7d3e351298013c1f1e665d29
- MD5 81e6644cd34a0f4f403d65c1c0b83873
- SHA1 58c21d71cc9e8dea4f6366e9d2d8005eabc47f6a
- SHA512 05daf150d11074a953bdb2b7071db6477305ef31c3d5d179a9fc3a9a9ba1e85d6c5a6df9622fe569893d39e041b4c2c0ff9218244a96a5f89019d2d1e5709996
- SSDEEP 12288:gN4fGjM8LjBTqKlZ41TtTuRWny8d+roTfREZW9Ax3K8CbEcieT6O48OwgIk5CTzT:cMw8K2tTuRWFsronbEqa6ZTK7pI
- TLSH T1D0359E17B79050B8D06EC17487569636EA72BC661B30AADF0390F6692F37BE0673E305
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-09_81e6644cd34a0f4f403d65c1c0b83873_amadey_cloudeye_cobalt-strike_elex_hijackloader_nymaim_r.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-09_81e6644cd34a0f4f403d65c1c0b83873_amadey_cloudeye_cobalt-strike_elex_hijackloader_nymaim_rhadamanthys_smoke-loader_vidar
- Size 1.1MB
- SHA256 9d55c6dd402f4ab54c896c6c52960e52d0c654bf7d3e351298013c1f1e665d29
- MD5 81e6644cd34a0f4f403d65c1c0b83873
- SHA1 58c21d71cc9e8dea4f6366e9d2d8005eabc47f6a
- SHA512 05daf150d11074a953bdb2b7071db6477305ef31c3d5d179a9fc3a9a9ba1e85d6c5a6df9622fe569893d39e041b4c2c0ff9218244a96a5f89019d2d1e5709996
- SSDEEP 12288:gN4fGjM8LjBTqKlZ41TtTuRWny8d+roTfREZW9Ax3K8CbEcieT6O48OwgIk5CTzT:cMw8K2tTuRWFsronbEqa6ZTK7pI
- TLSH T1D0359E17B79050B8D06EC17487569636EA72BC661B30AADF0390F6692F37BE0673E305
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory