2026-09-24_8517f0300f10e122263f914453f07eaa_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-24_8517f0300f10e122263f914453f07eaa_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader
Size 315KB
Sample260925-gjbysstxbt
SHA256 059700f2e202a90a50442b67d057a8017ebceaa7ac38a8437292a176aa4d6ce1
MD5 8517f0300f10e122263f914453f07eaa
SHA1 81e9aed0c57b979d61bcc2ac94556e7a9fbf309e
SHA512 de8908062570b71691ba3af845ac7fc2a5af53fe42e7f5218797c49c7802ea06c42f8e65bec96d72cbfae2c9f0d91087a17c3e2bf57e1a5a5e53bd60bb6dc07b
SSDEEP 6144:eAMC89m4saWj1nrIO/iDYPHKKWXOAaaeTA/84um8MtdlOpIk:DMCp4saWj1nrIW6YPH1AXq4inpIk
TLSH
T14D645D10A601F036F9B304768BBE4B6E892C9CA10B4525DB93C81DEE8B759E1F73571B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-24_8517f0300f10e122263f914453f07eaa_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

File Explorer

2026-09-24_8517f0300f10e122263f914453f07eaa_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

.exe 315KB

2026-09-24_8517f0300f10e122263f914453f07eaa_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

IMPHASH 21828721cab98c9eb41aa8a5961a2245
SHA256 059700f2e202a90a50442b67d057a8017ebceaa7ac38a8437292a176aa4d6ce1
MD5 8517f0300f10e122263f914453f07eaa
SHA1 81e9aed0c57b979d61bcc2ac94556e7a9fbf309e
SHA512 de8908062570b71691ba3af845ac7fc2a5af53fe42e7f5218797c49c7802ea06c42f8e65bec96d72cbfae2c9f0d91087a17c3e2bf57e1a5a5e53bd60bb6dc07b
SSDEEP 6144:eAMC89m4saWj1nrIO/iDYPHKKWXOAaaeTA/84um8MtdlOpIk:DMCp4saWj1nrIW6YPH1AXq4inpIk
TLSH
T14D645D10A601F036F9B304768BBE4B6E892C9CA10B4525DB93C81DEE8B759E1F73571B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

125184

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

GetLastInputInfo GetSystemMetrics GetForegroundWindow GetDC EmptyClipboard GetWindowTextW MessageBoxW GetWindowThreadProcessId SetProcessDPIAware LockWorkStation GetClipboardData SetClipboardData CloseClipboard OpenClipboard ExitWindowsEx PeekMessageW DispatchMessageW ReleaseDC TranslateMessage

gdi32

SelectObject DeleteObject CreateCompatibleDC CreateCompatibleBitmap BitBlt DeleteDC

advapi32

RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCloseKey GetUserNameW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken

mf

MFEnumDeviceSources

mfplat

MFShutdown MFCreateAttributes MFCreateMediaType MFStartup

mfreadwrite

MFCreateSourceReaderFromMediaSource

winhttp

WinHttpReceiveResponse WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpOpen

gdiplus

GdipSaveAddImage GdipCreateBitmapFromScan0 GdipCreateBitmapFromHBITMAP GdipSaveImageToFile GdipBitmapUnlockBits GdipGetImageEncodersSize GdipGetImageEncoders GdipSaveAdd GdipDisposeImage GdipCloneImage GdiplusShutdown GdiplusStartup GdipFree GdipAlloc GdipBitmapLockBits

winmm

waveInStart waveInAddBuffer waveInUnprepareHeader waveInPrepareHeader waveInClose waveInOpen waveInReset

ole32

CoInitializeEx CoTaskMemFree CoUninitialize

kernel32

FindClose SetFilePointerEx FindFirstFileExW FindNextFileW GetCommandLineA FreeEnvironmentStringsW GetCommandLineW GetEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize HeapReAlloc GlobalLock GetOEMCP GetACP IsValidCodePage EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW VirtualProtect GetFileType HeapFree HeapAlloc UnhandledExceptionFilter IsDebuggerPresent GetStdHandle GetProcAddress ExitProcess GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwind RaiseException InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetModuleHandleW GetStartupInfoW SetUnhandledExceptionFilter IsProcessorFeaturePresent CreateFileW DeleteFileW GetDiskFreeSpaceExW GetFileSize ReadFile WriteFile GetTempPathW CloseHandle SetHandleInformation GetLastError CreatePipe WaitForSingleObject Sleep GetCurrentProcess TerminateProcess CreateProcessA OpenProcess GlobalMemoryStatusEx GetTickCount GetTickCount64 GetModuleFileNameW GlobalAlloc GlobalUnlock WriteConsoleW QueryFullProcessImageNameW GetComputerNameW MultiByteToWideChar WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetProcessMemoryInfo QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection WakeAllConditionVariable EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-24_8517f0300f10e122263f914453f07eaa_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

user32

gdi32

advapi32

mf

mfplat

mfreadwrite

winhttp

gdiplus

winmm

ole32

kernel32

generic