General
- Target 2026-09-09_0f685ca76cd6c231ecb34492e4b34c0a_amadey_cobalt-strike_elex_hijackloader_remcos_smoke-loader
- Size 2.7MB
- Sample260910-alc6basfnd
- SHA256 554582992644f584faff8a9d20e50a4f88ca0afe6ad357d16c995047dbefd13e
- MD5 0f685ca76cd6c231ecb34492e4b34c0a
- SHA1 956d060949168390d5b4f3c488e057838ce61c37
- SHA512 04f523b2e93860fc8621d896aaba43f70397d0790d18a25560de678f8d072ecee8951098501bedd5a054c10110ef8a8507d033f4020fde75e032ca26a6842a24
- SSDEEP 49152:6ENwzIR257B1IqR6FoRvku04YLWVqtQF9Icgn+:6gwkQ7rIqMe23+
- TLSH T198D58E11BB0040B9F9E652B51ABFA1A8546C7DB0875870CFA1D877FA1E356E12E323C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-09_0f685ca76cd6c231ecb34492e4b34c0a_amadey_cobalt-strike_elex_hijackloader_remcos_smoke-loader.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-09_0f685ca76cd6c231ecb34492e4b34c0a_amadey_cobalt-strike_elex_hijackloader_remcos_smoke-loader.exe
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-09_0f685ca76cd6c231ecb34492e4b34c0a_amadey_cobalt-strike_elex_hijackloader_remcos_smoke-loader
- Size 2.7MB
- SHA256 554582992644f584faff8a9d20e50a4f88ca0afe6ad357d16c995047dbefd13e
- MD5 0f685ca76cd6c231ecb34492e4b34c0a
- SHA1 956d060949168390d5b4f3c488e057838ce61c37
- SHA512 04f523b2e93860fc8621d896aaba43f70397d0790d18a25560de678f8d072ecee8951098501bedd5a054c10110ef8a8507d033f4020fde75e032ca26a6842a24
- SSDEEP 49152:6ENwzIR257B1IqR6FoRvku04YLWVqtQF9Icgn+:6gwkQ7rIqMe23+
- TLSH T198D58E11BB0040B9F9E652B51ABFA1A8546C7DB0875870CFA1D877FA1E356E12E323C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops file in System32 directory