General
- Target 2026-10-22_28ab9f1c6d1870c6d4ef1b37439fcad5_amadey_cobalt-strike_elex_hijackloader_remcos_smoke-loader
- Size 2.0MB
- Sample261024-w5bbqawte1
- SHA256 c4db79dc5deb5eb7c54e95c8bf2f2bee9a66e7ab9c9a2fe5c0141154853cf3f2
- MD5 28ab9f1c6d1870c6d4ef1b37439fcad5
- SHA1 db757511fa26da43dba196fca954387b44fa17a4
- SHA512 8f5f3530753b90fbfae678b9a591491257eed57e19e38080263b91e4182eee9c68ce6e156bf8c51a0f27eed11aefb84a075f98b62ef3a36cac21a253b10de39f
- SSDEEP 24576:UENJKEt6dq8hXj8R2vxW870KHue5GqR6FokG81Cvz44sLy0aZJQ5Te6Lrdzk:UENwzIR257BxIqR6FoRvku04YLr
- TLSH T160A55A10AB508028FAE752F55AADE1BC951C7DF0879860CBB1D577FA46362F12D3328B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_28ab9f1c6d1870c6d4ef1b37439fcad5_amadey_cobalt-strike_elex_hijackloader_remcos_smoke-loader.exe
Resource
win10v2004-20260911-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_28ab9f1c6d1870c6d4ef1b37439fcad5_amadey_cobalt-strike_elex_hijackloader_remcos_smoke-loader.exe
Resource
win11ltsc2024-20260911-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-22_28ab9f1c6d1870c6d4ef1b37439fcad5_amadey_cobalt-strike_elex_hijackloader_remcos_smoke-loader
- Size 2.0MB
- SHA256 c4db79dc5deb5eb7c54e95c8bf2f2bee9a66e7ab9c9a2fe5c0141154853cf3f2
- MD5 28ab9f1c6d1870c6d4ef1b37439fcad5
- SHA1 db757511fa26da43dba196fca954387b44fa17a4
- SHA512 8f5f3530753b90fbfae678b9a591491257eed57e19e38080263b91e4182eee9c68ce6e156bf8c51a0f27eed11aefb84a075f98b62ef3a36cac21a253b10de39f
- SSDEEP 24576:UENJKEt6dq8hXj8R2vxW870KHue5GqR6FokG81Cvz44sLy0aZJQ5Te6Lrdzk:UENwzIR257BxIqR6FoRvku04YLr
- TLSH T160A55A10AB508028FAE752F55AADE1BC951C7DF0879860CBB1D577FA46362F12D3328B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10- Custom signature
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Executes dropped EXE
Loads dropped DLL
Drops file in System32 directory