Extracted

• • Target
    2026-10-01_e598728a3c119ef1a8060097ac1d583b_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader
  • Size 289KB
  • SHA256 aa6ce90437fbc9c88f3e1798e38cd0839e11296b81f500fafc2a70e0d8416a16
  • MD5 e598728a3c119ef1a8060097ac1d583b
  • SHA1 aa60d9d7e6da17ec604f66221b70a25587bca47b
  • SHA512 4017302beef4c1d899eae5f1f9ce550881fc437fcdba3a08ccf39ef949559ecc1d0bed611e5f3e250a0fd773c1667606e1f9f185f7a419c4ee07909e4d6efb49
  • SSDEEP 3072:gU4I8Cj89IOr3zfc36e/66rDMgXIGvKSsXW+GuRqw1JOCdlU8Q0M+1m/FX/LSLv0:gHO8c3DXXdCRXWwQkLlpd1m/1YAOI3R
  • TLSH
    T17E547D00B181D436E9B305334A7D8BBD866DBD600B1558EB93D81DAECF742D1BA32B67
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionxmrigminerpersistencethemidatrojanupx

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Contacts a large (22851) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Detects executables embedding registry key / value combination manipulating RDP / Terminal Services

  • Detects executables packed with Themida

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • UPX dump on OEP (original entry point)

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2