2026-09-27_74ce5967d245790b2131453e42b374cc_amadey_cobalt-strike_elex_medusalocker_metamorfo_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-27_74ce5967d245790b2131453e42b374cc_amadey_cobalt-strike_elex_medusalocker_metamorfo_njrat_remcos
Size 527KB
Sample260928-e6rawsvcqd
SHA256 045fe13eb93b624ce5168198f2ef8b1bcd0b7e08cc00a62b00dfba98ad845ac9
MD5 74ce5967d245790b2131453e42b374cc
SHA1 e98e7d7a1b44fb0d1df2a1076ed25f3cdee784f6
SHA512 a72b5ac212882a5346b52d613df1df1ba3200ff68a8e3b4109d19530d2109f95364462e49bd5e26ff61e0b09068165820d7cc97d9176b6d15a6f532c5802237b
SSDEEP 12288:0NhJLFBtYrJjWRIzPQ5h939ciScpxsPOgEPoXfh4M089:0Nh7SaI8PZ9pxsPfEPafhV9
TLSH
T14CB4AEE37553C075E992017A9D6EFB1916BCEE308B2505C7B3C82A59ED206C3573B2A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-27_74ce5967d245790b2131453e42b374cc_amadey_cobalt-strike_elex_medusalocker_metamorfo_njrat_remcos

File Explorer

2026-09-27_74ce5967d245790b2131453e42b374cc_amadey_cobalt-strike_elex_medusalocker_metamorfo_njrat_remcos

.exe 527KB

2026-09-27_74ce5967d245790b2131453e42b374cc_amadey_cobalt-strike_elex_medusalocker_metamorfo_njrat_remcos

IMPHASH 75d0d6eb4dc0a41689233896c7c5a6d1
SHA256 045fe13eb93b624ce5168198f2ef8b1bcd0b7e08cc00a62b00dfba98ad845ac9
MD5 74ce5967d245790b2131453e42b374cc
SHA1 e98e7d7a1b44fb0d1df2a1076ed25f3cdee784f6
SHA512 a72b5ac212882a5346b52d613df1df1ba3200ff68a8e3b4109d19530d2109f95364462e49bd5e26ff61e0b09068165820d7cc97d9176b6d15a6f532c5802237b
SSDEEP 12288:0NhJLFBtYrJjWRIzPQ5h939ciScpxsPOgEPoXfh4M089:0Nh7SaI8PZ9pxsPfEPafhV9
TLSH
T14CB4AEE37553C075E992017A9D6EFB1916BCEE308B2505C7B3C82A59ED206C3573B2A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

165472

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\458571\out\Release\360EvtMgr.pdb

kernel32

SetFilePointer WriteFile OutputDebugStringW CloseHandle RaiseException InitializeCriticalSection DeleteCriticalSection WaitForSingleObject GetCurrentProcess GetCurrentProcessId GetCurrentThreadId FlushInstructionCache GetLocalTime lstrcmpiW lstrlenW FileTimeToSystemTime SystemTimeToFileTime CreateDirectoryW GetExitCodeProcess FreeResource CreateProcessW GetStartupInfoW ExpandEnvironmentStringsW GetFileSizeEx SetEndOfFile GetLongPathNameW SetUnhandledExceptionFilter DeviceIoControl ProcessIdToSessionId OpenProcess GetSystemDirectoryW VirtualProtect CreateToolhelp32Snapshot Process32FirstW Process32NextW GetFileSize ReadFile GetFileAttributesW IsDebuggerPresent InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList IsProcessorFeaturePresent FlushFileBuffers QueryPerformanceCounter TryEnterCriticalSection FormatMessageW LocalFree HeapLock HeapUnlock HeapWalk ReleaseMutex OpenThread TlsAlloc TlsGetValue TlsSetValue TlsFree CreateFileA LocalFileTimeToFileTime SetFilePointerEx SetEvent ResetEvent UnhandledExceptionFilter CreateTimerQueue SignalObjectAndWait SwitchToThread CreateThread SetThreadPriority GetThreadPriority CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetProcessAffinityMask RegisterWaitForSingleObject UnregisterWait GetCurrentThread FreeLibraryAndExitThread DuplicateHandle ReleaseSemaphore InterlockedFlushSList QueryDepthSList UnregisterWaitEx RtlUnwind WideCharToMultiByte FindNextFileW FindFirstFileW FindClose FileTimeToLocalFileTime DeleteFileW GetUserDefaultUILanguage MultiByteToWideChar GetPrivateProfileStringW LoadLibraryW GetModuleFileNameW GetVersionExW GetVersion LeaveCriticalSection EnterCriticalSection SetCurrentDirectoryW FindResourceW SizeofResource LockResource LoadResource GetModuleHandleW FindResourceExW GetProcessHeap HeapSize VirtualFree SetThreadAffinityMask LoadLibraryExW GetProcAddress FreeLibrary GetTickCount GetSystemTimeAsFileTime CreateFileW GetThreadTimes TerminateProcess GetProcessTimes CreateSemaphoreW Sleep CreateEventW CreateMutexW WaitForSingleObjectEx InitializeCriticalSectionAndSpinCount HeapFree HeapReAlloc HeapAlloc HeapDestroy SetLastError GetLastError VirtualAlloc

user32

DispatchMessageW PeekMessageW PostMessageW CreatePopupMenu DestroyMenu TrackPopupMenu InsertMenuItemW SetWindowTextW GetSystemMetrics CopyRect ClientToScreen KillTimer SetTimer GetActiveWindow MessageBoxW GetLastInputInfo DialogBoxParamW PostQuitMessage MonitorFromWindow DefWindowProcW InvalidateRect GetClientRect IsDialogMessageW LoadImageW GetParent GetWindowLongW MapWindowPoints EndDialog GetMonitorInfoW MonitorFromPoint SystemParametersInfoW GetWindow GetMessageW GetWindowRect RegisterClassW SetWindowPos SendMessageW RegisterWindowMessageW SetForegroundWindow WaitForInputIdle FindWindowW SetWindowLongW CharNextW CreateDialogParamW ShowWindow DestroyWindow GetClassInfoW UnregisterClassW TranslateMessage

advapi32

RegQueryValueExW CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW DuplicateTokenEx OpenProcessToken CreateProcessAsUserW RegQueryInfoKeyW RegEnumKeyExW RegSetValueExW RegQueryValueExA RegOpenKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey

shell32

SHGetSpecialFolderPathW ord165 ShellExecuteW

ole32

CoUninitialize CoInitialize CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance

oleaut32

SysAllocString SysFreeString SysStringByteLen SysAllocStringByteLen VarUI4FromStr VariantClear VarBstrCmp VariantInit DispCallFunc SafeArrayCreate SafeArrayDestroy SafeArrayGetUBound SafeArrayGetLBound SafeArrayLock SafeArrayUnlock SafeArrayCopy SafeArrayGetVartype VariantCopy

shlwapi

PathIsDirectoryW SHSetValueW PathFindFileNameW PathAddBackslashW StrStrIW StrCmpNIA SHGetValueW PathRemoveFileSpecW PathCombineW PathAppendW PathFileExistsW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

psapi

EnumProcessModules GetModuleFileNameExW

ntdll

RtlDllShutdownInProgress

comctl32

InitCommonControlsEx

imm32

ImmDisableIME

msvcrt

__DestructExceptionObject _wcsupr ___lc_codepage_func _lock _unlock _iob __pctype_func iswctype ___mb_cur_max_func _wcslwr __dllonexit __set_app_type _wcmdln _exit __RTDynamicCast _control87 _XcptFilter _fmode mbtowc strrchr _CIexp _CIlog10 ceil _clearfp ?terminate@@YAXXZ _wcstoui64 _msize __CxxFrameHandler _initterm __setusermatherr atexit __wgetmainargs _amsg_exit _cexit strtol wcstol ___lc_handle_func tolower abort realloc __uncaught_exception ??0exception@@QAE@XZ _CIsqrt __p__commode _c_exit localeconv ?what@exception@@UBEPBDXZ ??1exception@@UAE@XZ ??0exception@@QAE@ABV0@@Z ??0exception@@QAE@ABQBD@Z calloc wcschr memcmp _beginthreadex _strtoui64 strtoul wcstoul malloc free wcsrchr ??_U@YAPAXI@Z atoi exit _wtoi _wcsnicmp _wcsicmp wcsspn wcscspn wcsstr _errno ??_V@YAXPAX@Z ??3@YAXPAX@Z memmove _CxxThrowException ??2@YAPAXI@Z memset memcpy

generic

count=2, id=260, version=26706,

count=12, id=259, version=26706,

count=7, id=261, version=26715,

count=4, id=257, version=27032,

count=37, id=261, productName=VS2019 v16.2.3 build 27905, version=27905,

count=2, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=4, id=261, version=27024,

count=25, id=199, version=41118,

count=2, id=260, version=27031,

count=9, id=261, productName=VS2017 v15.9.7 build 27027, version=27027,

count=1, id=263, version=26715,

count=3, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=10, id=260, productName=VS2017 v15.7.5 build 26433, version=26433,

count=21, id=260, version=27032,

count=97, id=261, version=27032,

count=8, id=260, version=26715,

count=2, id=262, version=26715,

count=45, id=257, version=26715,

count=806, id=1, productName=Unmarked objects,

count=11, id=261, version=26706,

count=18, id=261, version=27031,

count=14, id=261, version=27040,

count=1, id=255, version=27040,

count=1, id=151,

count=1, id=258, version=27040,