2026-11-01_c19220e869285547e217a0cbcdfa49e6_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_c19220e869285547e217a0cbcdfa49e6_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader
Size 423KB
Sample261102-ln4a3aaz6m
SHA256 53d3d801d0d93cec3f355f9bf57ad0c206c78d80db33a0fa6bf9687cccfc87fd
MD5 c19220e869285547e217a0cbcdfa49e6
SHA1 8531842402c00c0bea16aff5a0cbf32e4e95d761
SHA512 02c6199380d5830dbaee1c2343a142b59ec7cb56031c50f456a5796c001ddb8c3ce8b8c1b7dba45247bbc2b3cff540e18b90c26d5d3339cf74f470d56bbd6c9c
SSDEEP 12288:CEU4CYwJk4xanpKs5+kZy6Xw7pymp4Fusj+M:CEU4C1++wpD+kk6Xw794FzR
TLSH
T11F948E207586C031E57215714EA8EFB6967DF9300B6708C773E40BBA5E242C1AF76B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-11-01_c19220e869285547e217a0cbcdfa49e6_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

.exe 423KB

2026-11-01_c19220e869285547e217a0cbcdfa49e6_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

IMPHASH fcf4a9e95b0263729311c328d08b4720
SHA256 53d3d801d0d93cec3f355f9bf57ad0c206c78d80db33a0fa6bf9687cccfc87fd
MD5 c19220e869285547e217a0cbcdfa49e6
SHA1 8531842402c00c0bea16aff5a0cbf32e4e95d761
SHA512 02c6199380d5830dbaee1c2343a142b59ec7cb56031c50f456a5796c001ddb8c3ce8b8c1b7dba45247bbc2b3cff540e18b90c26d5d3339cf74f470d56bbd6c9c
SSDEEP 12288:CEU4CYwJk4xanpKs5+kZy6Xw7pymp4Fusj+M:CEU4C1++wpD+kk6Xw794FzR
TLSH
T11F948E207586C031E57215714EA8EFB6967DF9300B6708C773E40BBA5E242C1AF76B6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

e2:1f:e1:ed:e3:2c:1f:bf:0a:a5:af:d4:e9:b8:cf:7e:17:75:1c:dc:77:9a:ad:e2:47:6e:a6:c6:03:05:c5:f5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

Chains

Oct 20, 2026

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

Serial Number

79:01:99:cd:1b:2e:9a:13:d7:c9:8f:fd

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 21, 2026 - Jul 22, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

141840

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\Webhost\20-10-2026\WindowsBuilds\ACP_AGENT\14863623\appctrlbuild\SA_SRC\ACP\Release\ACPipelogServer.pdb

crypt32

CryptEncodeObjectEx CertFindCertificateInStore CertFreeCertificateContext CryptGetMessageCertificates CertCloseStore CryptMsgUpdate CryptMsgClose CryptMsgOpenToDecode CryptMsgGetParam CryptQueryObject

wintrust

WinVerifyTrust

imagehlp

ImageGetCertificateData ImageGetCertificateHeader

advapi32

RegCloseKey CloseTrace ProcessTrace OpenTraceW EnableTraceEx2 ControlTraceW StartTraceW InitializeAcl CreateWellKnownSid AddAccessAllowedAce RegGetValueW OpenProcessToken AdjustTokenPrivileges InitializeSecurityDescriptor SetSecurityDescriptorDacl LookupPrivilegeValueW RegOpenKeyExW RegQueryValueExW RegGetValueA

kernel32

FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP SetEnvironmentVariableW VerSetConditionMask CreateFileW FindClose WriteFile DecodePointer CloseHandle GetLastError HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection SetEvent OpenEventA Sleep GetCurrentProcess GetCurrentProcessId TerminateProcess ProcessIdToSessionId OpenProcess GetSystemDirectoryW FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryExW LoadResource LockResource SizeofResource FindResourceW LocalFree FormatMessageW QueryFullProcessImageNameW VerifyVersionInfoW MultiByteToWideChar WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentThreadId CreateFileA FlushFileBuffers ReadFile ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW CreateIoCompletionPort GetQueuedCompletionStatus ExitProcess CreateThread GetSystemInfo GetSystemTimeAsFileTime GetLocalTime FindResourceExW GlobalAlloc GlobalFree GetNamedPipeClientProcessId FileTimeToSystemTime GetTimeZoneInformation MoveFileW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection SetLastError SleepEx WaitForSingleObjectEx SetFilePointerEx DeleteFileW IsValidCodePage WriteConsoleW SetEndOfFile SetStdHandle ReadConsoleW GetFileSizeEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetCommandLineW GetCommandLineA GetStdHandle GetModuleFileNameW GetConsoleMode GetConsoleOutputCP GetFileType FreeLibraryAndExitThread ExitThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RaiseException QueryPerformanceCounter QueryPerformanceFrequency FormatMessageA GetLocaleInfoEx InitOnceBeginInitialize InitOnceComplete ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI GetFileInformationByHandleEx GetStringTypeW FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW IsProcessorFeaturePresent EncodePointer LCMapStringEx GetCPInfo IsDebuggerPresent OutputDebugStringW UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead RtlUnwind

shlwapi

StrStrIA

tdh

TdhGetProperty TdhGetPropertySize

bcrypt

BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider

Name

.text

Size

281KB

Virtual Size

281KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

94KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_c19220e869285547e217a0cbcdfa49e6_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

crypt32

wintrust

imagehlp

advapi32

kernel32

shlwapi

tdh

bcrypt

generic