2026-09-18_9aaf13e39d55ede35abf334c235bdbb1_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

General

Target
2026-09-18_9aaf13e39d55ede35abf334c235bdbb1_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader
Size 667KB
Sample260918-qsp2fsfe44
SHA256 f4a52665f1954c0313a1072d358842a4dfd8d7bad96856aa4e5e60e2d40f6137
MD5 9aaf13e39d55ede35abf334c235bdbb1
SHA1 9f958803ee4958c7c0ebfc7fb28455f83c18ad7d
SHA512 6ceff084cf964f137487a49192a0254f2b9d3a9f2ff585d65d34df17db0f4cb02815c2ef710554adccd2c706f577c317351b5816b2e594ab0ddc50b1bb63b48f
SSDEEP 12288:U9Iqw2kpqmJWYteUgQPMkSMDXbSufdojJqB9AVaxmxd3:UGpqm1UUbPlDjdolqB9AVKod3
TLSH
T1F9E45D9077AA7F71C333C6B46F587B22069C5C108611D966FB8187F9B59008C7BAEF29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-18_9aaf13e39d55ede35abf334c235bdbb1_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

File Explorer

2026-09-18_9aaf13e39d55ede35abf334c235bdbb1_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

.exe 667KB

2026-09-18_9aaf13e39d55ede35abf334c235bdbb1_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

IMPHASH 6e6a6c10b1421c1bc516d8f6ccb4ea4b
SHA256 f4a52665f1954c0313a1072d358842a4dfd8d7bad96856aa4e5e60e2d40f6137
MD5 9aaf13e39d55ede35abf334c235bdbb1
SHA1 9f958803ee4958c7c0ebfc7fb28455f83c18ad7d
SHA512 6ceff084cf964f137487a49192a0254f2b9d3a9f2ff585d65d34df17db0f4cb02815c2ef710554adccd2c706f577c317351b5816b2e594ab0ddc50b1bb63b48f
SSDEEP 12288:U9Iqw2kpqmJWYteUgQPMkSMDXbSufdojJqB9AVaxmxd3:UGpqm1UUbPlDjdolqB9AVKod3
TLSH
T1F9E45D9077AA7F71C333C6B46F587B22069C5C108611D966FB8187F9B59008C7BAEF29
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

20940

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WriteProcessMemory GetCurrentProcess VirtualAlloc WaitForDebugEvent K32GetMappedFileNameA QueryDosDeviceA ContinueDebugEvent UnmapViewOfFile GetLastError CloseHandle VirtualProtectEx ReadProcessMemory FlushInstructionCache CreateProcessA CreateFileMappingW MapViewOfFile CreateFileW HeapSize GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW TerminateProcess RtlUnwind RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP WriteConsoleW

user32

MessageBoxA

version

GetFileVersionInfoSizeA VerQueryValueA GetFileVersionInfoA

Name

.text

Size

135KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

473KB

Virtual Size

476KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-18_9aaf13e39d55ede35abf334c235bdbb1_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

kernel32

user32

version

generic