2026-11-07_4f9ec00e2000d88a85fd06a9022c284c_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-07_4f9ec00e2000d88a85fd06a9022c284c_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader
Size 470KB
Sample261107-rs1nmacw7v
SHA256 41a05b462c0b7c0e54f0eda33ef0a92a9df7bb79b66861995eb11c3baf94056b
MD5 4f9ec00e2000d88a85fd06a9022c284c
SHA1 387a183c65f60f207b3ef6bafb8e7b030d009eb0
SHA512 8f7107a66b0831cb7357792dd375b8ef74605f2c36534c58a7a0e05303d94edb1f4536644e06502f90f64797ca2e36ac4646ee5bd0f6b8d8e1952982a340e879
SSDEEP 12288:GM+anNqLml5a6EdkQgUmR7G9QK3wJx+qSfF0:GMBnNqylh+mRW/3wJxfSf
TLSH
T172A49D15F9D1BC72D46209384DE3AAB59DBDBD300E25892BB7DC0B1D8F313B1921A297
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-07_4f9ec00e2000d88a85fd06a9022c284c_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader

File Explorer

2026-11-07_4f9ec00e2000d88a85fd06a9022c284c_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader

.exe 470KB

2026-11-07_4f9ec00e2000d88a85fd06a9022c284c_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader

IMPHASH acc4113d8c105bacc71115ac02c27f53
SHA256 41a05b462c0b7c0e54f0eda33ef0a92a9df7bb79b66861995eb11c3baf94056b
MD5 4f9ec00e2000d88a85fd06a9022c284c
SHA1 387a183c65f60f207b3ef6bafb8e7b030d009eb0
SHA512 8f7107a66b0831cb7357792dd375b8ef74605f2c36534c58a7a0e05303d94edb1f4536644e06502f90f64797ca2e36ac4646ee5bd0f6b8d8e1952982a340e879
SSDEEP 12288:GM+anNqLml5a6EdkQgUmR7G9QK3wJx+qSfF0:GMBnNqylh+mRW/3wJxfSf
TLSH
T172A49D15F9D1BC72D46209384DE3AAB59DBDBD300E25892BB7DC0B1D8F313B1921A297
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

77324

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle CloseHandle DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection VirtualFree VirtualAlloc LocalFree LocalAlloc GetVersion GetCurrentThreadId GetThreadLocale GetStartupInfoA GetModuleFileNameA GetLocaleInfoA GetCommandLineA FreeLibrary ExitProcess WriteFile UnhandledExceptionFilter RtlUnwind RaiseException GetStdHandle TlsSetValue TlsGetValue LocalAlloc GetModuleHandleA WriteProcessMemory WriteFile WinExec VirtualFreeEx VirtualAllocEx TerminateProcess SuspendThread SizeofResource SetThreadContext SetLastError SetFileTime SetFilePointer SetFileAttributesA SetEndOfFile ResumeThread ReadFile OpenProcess OpenFileMappingA MapViewOfFile LockResource LoadResource LoadLibraryA IsBadReadPtr GlobalFree GlobalAlloc GetWindowsDirectoryA GetVersionExA GetThreadContext GetTempPathA GetTempFileNameA GetSystemDirectoryA GetShortPathNameA GetProcAddress GetModuleHandleA GetLocalTime GetFileTime GetFileSize GetDriveTypeA GetCurrentProcessId GetCurrentProcess GetComputerNameA GetACP FreeResource FreeLibrary FindResourceA FindNextFileA FindFirstFileA FindClose FileTimeToLocalFileTime FileTimeToDosDateTime ExitProcess DuplicateHandle DeleteFileA CreateThread CreateProcessA CreateFileMappingA CreateFileA CopyFileA CompareStringA CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle LoadLibraryA GetProcAddress

kernelbase

WideCharToMultiByte MultiByteToWideChar Sleep

user32

GetKeyboardType MessageBoxA CharNextA CreateWindowExA UpdateWindow TranslateMessage SendMessageA RegisterClassA PostThreadMessageA PostMessageA PeekMessageA LoadCursorA GetWindowTextA GetMessageA FindWindowExA FindWindowA DispatchMessageA DefWindowProcA

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey RegSetValueExA RegCreateKeyExA RegCloseKey FreeSid

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen

mpr

WNetOpenEnumA WNetEnumResourceA WNetCloseEnum WNetCancelConnectionA WNetCancelConnection2A WNetAddConnection2A

version

VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA

wsock32

WSACleanup WSAStartup gethostname gethostbyname inet_ntoa

winmm

waveOutSetVolume waveOutGetVolume

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-07_4f9ec00e2000d88a85fd06a9022c284c_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader

kernel32

kernelbase

user32

advapi32

oleaut32

mpr

version

wsock32

winmm

generic