2026-11-01_a1958f4ed5b3df0e657955051269db89_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader

General

Target
2026-11-01_a1958f4ed5b3df0e657955051269db89_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader
Size 299KB
Sample261102-qdd1msct7m
SHA256 8bce98973595c356fb07bd05d80a3fac6e0e8d715df63f95ecac372ae0d08d95
MD5 a1958f4ed5b3df0e657955051269db89
SHA1 5a4c33b11b279dec65a43a06dfb462f085910dc4
SHA512 4983b7ebab173dcebe6da9653c14d87caf145058aeab78382fef875ba633912c85a46ccf6194e2482c0d6a1121f4e1ee45cb81958c291a974e36fb56d9dfb8f5
SSDEEP 6144:K6wSXCs7zYA9xiNFiVg7s/uDoeBvhI7QkWXWzORSKLcd8:KyXCs/YAh/elvhI7ERSqcd8
TLSH
T18954C0A1B4C08472C862243345F1DB715A3E7C745CA1894FA3AD7A399F733D2522AADF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_a1958f4ed5b3df0e657955051269db89_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader

File Explorer

2026-11-01_a1958f4ed5b3df0e657955051269db89_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader

.exe 299KB

2026-11-01_a1958f4ed5b3df0e657955051269db89_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader

IMPHASH 41c44b16de8f36f3f919d8affec6b7e1
SHA256 8bce98973595c356fb07bd05d80a3fac6e0e8d715df63f95ecac372ae0d08d95
MD5 a1958f4ed5b3df0e657955051269db89
SHA1 5a4c33b11b279dec65a43a06dfb462f085910dc4
SHA512 4983b7ebab173dcebe6da9653c14d87caf145058aeab78382fef875ba633912c85a46ccf6194e2482c0d6a1121f4e1ee45cb81958c291a974e36fb56d9dfb8f5
SSDEEP 6144:K6wSXCs7zYA9xiNFiVg7s/uDoeBvhI7QkWXWzORSKLcd8:KyXCs/YAh/elvhI7ERSqcd8
TLSH
T18954C0A1B4C08472C862243345F1DB715A3E7C745CA1894FA3AD7A399F733D2522AADF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

38199

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\javaw_objs\javaw.pdb

advapi32

RegEnumKeyA RegOpenKeyExA RegQueryValueExA RegCloseKey

user32

CharNextExA MessageBoxA

comctl32

InitCommonControlsEx

kernel32

HeapSize WriteConsoleW GetTimeZoneInformation GetCommandLineA CloseHandle GetLastError QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObject GetExitCodeProcess GetExitCodeThread CreateProcessA FreeLibrary GetModuleFileNameA GetModuleHandleA GetProcAddress LoadLibraryA LocalFree FormatMessageA FindClose FindFirstFileA FindNextFileA UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW GetFileSizeEx RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW RaiseException GetCommandLineW ExitProcess GetModuleHandleExW SetFilePointerEx CreateThread ExitThread FreeLibraryAndExitThread CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetStdHandle WriteFile GetModuleFileNameW ReadFile GetConsoleMode ReadConsoleW HeapAlloc HeapFree CompareStringW LCMapStringW MultiByteToWideChar WideCharToMultiByte IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetConsoleOutputCP HeapReAlloc GetFileAttributesExW FlushFileBuffers GetCurrentDirectoryW GetFullPathNameW FindFirstFileExW FindNextFileW GetStringTypeW GetProcessHeap SetEndOfFile DecodePointer

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_a1958f4ed5b3df0e657955051269db89_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader

advapi32

user32

comctl32

kernel32

generic