2026-10-21_7353367d1ca6cde49ce901b089a05f62_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-21_7353367d1ca6cde49ce901b089a05f62_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader
Size 367KB
Sample261022-1f9kfabf23
SHA256 d9741cca4cc808fc55a3969d97d9acd303394854abcab8cfd4ecbff69e2ea6ac
MD5 7353367d1ca6cde49ce901b089a05f62
SHA1 96c629ccee2df6c6524fa192c193d23c4829ff0b
SHA512 6e9107a75e9b399157241a2be29bbfc234e238e9a8c3c528f92ca1ff5d1afbff324bd240e4de06e3be48d8768ffcf36ad383b8fc8bf70a115a622916981baf9f
SSDEEP 6144:jW/itepm4jVNf42ZOuRT/bfY1R+n4XKy99hOfSCM4NmT19RvU:jW/3/jVRlgq2R+nuueiURvU
TLSH
T1E6848D32FA51D432D57249315B7ACB76183DBA711FA1A9CBA3C40DF99970AC06738B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-21_7353367d1ca6cde49ce901b089a05f62_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

.exe 367KB

2026-10-21_7353367d1ca6cde49ce901b089a05f62_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

IMPHASH 473496c1ace4b704c69f6ca2dc32ed0f
SHA256 d9741cca4cc808fc55a3969d97d9acd303394854abcab8cfd4ecbff69e2ea6ac
MD5 7353367d1ca6cde49ce901b089a05f62
SHA1 96c629ccee2df6c6524fa192c193d23c4829ff0b
SHA512 6e9107a75e9b399157241a2be29bbfc234e238e9a8c3c528f92ca1ff5d1afbff324bd240e4de06e3be48d8768ffcf36ad383b8fc8bf70a115a622916981baf9f
SSDEEP 6144:jW/itepm4jVNf42ZOuRT/bfY1R+n4XKy99hOfSCM4NmT19RvU:jW/3/jVRlgq2R+nuueiURvU
TLSH
T1E6848D32FA51D432D57249315B7ACB76183DBA711FA1A9CBA3C40DF99970AC06738B23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

a7:0f:e9:47:1d:dd:70:fc:b5:78:d7:ac:6f:72:4d:94:3f:d4:5b:ad:32:eb:4e:53:0d:57:08:f1:75:b4:49:bf

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=000681038,CN=Bitsum Technologies (Bitsum LLC),O=Bitsum Technologies (Bitsum LLC),L=Morristown,ST=Tennessee,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130954656e6e6573736565,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Oct 1, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

08:c1:a2:26:80:ab:e5:ed:39:c3:d6:76:63:fe:27:15

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 12, 2025 - Mar 28, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

146146

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\pl\output\vistammsc.exe.pdb

shell32

SHCreateDirectoryExW SHGetSpecialFolderPathW

kernel32

CompareStringOrdinal GetLogicalProcessorInformationEx GetActiveProcessorCount GetActiveProcessorGroupCount CreateProcessW GetStartupInfoW GetWindowsDirectoryW GetVersionExW OutputDebugStringW TerminateThread SetEvent CreateEventW DeleteCriticalSection DecodePointer InitializeCriticalSectionEx GetLastError MultiByteToWideChar GetExitCodeProcess GetFileAttributesW CreateFileW GetSystemTimeAsFileTime WaitForSingleObject CloseHandle GetModuleHandleW ExitProcess FreeLibrary GetUserDefaultUILanguage VerSetConditionMask DeleteFileW GetFileSize ReadFile WriteFile SetLastError GetCurrentProcess GetCurrentProcessId GetModuleFileNameW GetProcAddress GlobalAlloc LoadLibraryW GlobalLock LocalFree VerifyVersionInfoW WideCharToMultiByte LocalAlloc LocalLock LocalUnlock MulDiv GetNumaHighestNodeNumber GetNumaNodeProcessorMask InitializeCriticalSectionAndSpinCount EnterCriticalSection LeaveCriticalSection Sleep FindClose FindNextFileW FlushFileBuffers SetEndOfFile IsDebuggerPresent RaiseException ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId GetStringTypeW LoadLibraryExW QueryPerformanceCounter EncodePointer GetCPInfo WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter FindResourceExW TerminateProcess IsProcessorFeaturePresent InitializeSListHead RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW GetStdHandle GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect LCMapStringW SetFilePointerEx FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetConsoleOutputCP GetConsoleMode WriteConsoleW FindResourceW LoadResource LockResource SizeofResource GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy GetSystemInfo GlobalUnlock SetUnhandledExceptionFilter

user32

KillTimer GetSystemMetrics GetSystemMenu EnableMenuItem DrawIcon DrawTextW SetForegroundWindow BeginPaint EndPaint RedrawWindow MessageBeep GetSysColor DrawFocusRect FillRect FrameRect SetRect InflateRect OffsetRect GetParent GetLastActivePopup GetWindow LoadIconW DestroyIcon IsDialogMessageW WinHelpW SystemParametersInfoW CreateWindowExW IsDlgButtonChecked UpdateWindow GetDialogBaseUnits CheckDlgButton CreateDialogIndirectParamW MoveWindow DestroyWindow PostQuitMessage WaitMessage PeekMessageW DispatchMessageW TranslateMessage GetAsyncKeyState GetClassNameW EnumChildWindows SetWindowLongW GetWindowLongW GetWindowRect GetClientRect GetWindowTextW SetWindowTextW InvalidateRect IsWindowEnabled EmptyClipboard SetClipboardData CloseClipboard OpenClipboard SetWindowPos IsWindow GetActiveWindow MessageBoxW LoadStringW SendMessageW ShowWindow SetPropW DialogBoxParamW GetDlgItem SetDlgItemTextW SetDlgItemInt GetDlgItemTextW GetDlgItemInt PostMessageW EnableWindow SetTimer SetFocus EndDialog

comdlg32

GetSaveFileNameW

advapi32

RegDeleteValueW RegEnumKeyExW RegSetValueExW RegQueryValueExW RegCreateKeyExW RegCloseKey RegOpenKeyExW RegQueryInfoKeyW

bcrypt

BCryptFinishHash BCryptHashData BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptCreateHash BCryptDestroyHash

uxtheme

SetWindowTheme IsThemeActive OpenThemeData CloseThemeData GetThemeColor

dwmapi

DwmSetWindowAttribute

comctl32

ord412 InitCommonControlsEx ord410 ord413

gdi32

CreateFontIndirectW CreateDCW SetTextColor SetBkMode SetBkColor SelectObject GetTextExtentPoint32W DeleteObject DeleteDC Rectangle GetTextMetricsW ExtCreatePen Polyline CreateSolidBrush CreatePen

Name

.text

Size

247KB

Virtual Size

247KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

77KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-21_7353367d1ca6cde49ce901b089a05f62_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

shell32

kernel32

user32

comdlg32

advapi32

bcrypt

uxtheme

dwmapi

comctl32

gdi32

generic