General
- Target 2026-10-28_9ba9903f96285fe80f1be64f49e19eee_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njrat_nymaim_rhadamanthys_smoke-loader
- Size 494KB
- Sample261029-2payxafv3s
- SHA256 31ce462fd9d2d1e41c8ee0f4a8afa1f598072f0defb4816c115554d8f3111c1e
- MD5 9ba9903f96285fe80f1be64f49e19eee
- SHA1 ab9f3a52d27cdc922c2cb781b68c556f4787a848
- SHA512 0f2a11ce834f08f34a2aba5d0b58aa21c0d36983ac113d7dca52dd000cd17b1f4a1efd302ffbaa212b6e08d68725987c229bffebc7cc5ccb97f287bfac9720fa
- SSDEEP 12288:GaoVmp+84YX7IKucTm3RhMfoSBjA9U2Yxh+ZgYiuWXx:GDVmpzT0fcT++foSBWU2YxhkgYiuWXx
- TLSH T148B46B1139E48E72D0BF80354AE19A36A67BFC315E114FEB53906F4D3E31A819527B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-28_9ba9903f96285fe80f1be64f49e19eee_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe
Resource
win10v2004-20260911-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-28_9ba9903f96285fe80f1be64f49e19eee_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njrat_nymaim_rhadamanthys_smoke-loader
- Size 494KB
- SHA256 31ce462fd9d2d1e41c8ee0f4a8afa1f598072f0defb4816c115554d8f3111c1e
- MD5 9ba9903f96285fe80f1be64f49e19eee
- SHA1 ab9f3a52d27cdc922c2cb781b68c556f4787a848
- SHA512 0f2a11ce834f08f34a2aba5d0b58aa21c0d36983ac113d7dca52dd000cd17b1f4a1efd302ffbaa212b6e08d68725987c229bffebc7cc5ccb97f287bfac9720fa
- SSDEEP 12288:GaoVmp+84YX7IKucTm3RhMfoSBjA9U2Yxh+ZgYiuWXx:GDVmpzT0fcT++foSBWU2YxhkgYiuWXx
- TLSH T148B46B1139E48E72D0BF80354AE19A36A67BFC315E114FEB53906F4D3E31A819527B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory