2026-11-12_4fc36db679b01d016a44ae77f4dd004a_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

General

Target
2026-11-12_4fc36db679b01d016a44ae77f4dd004a_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader
Size 242KB
Sample261113-dsxp3sfx3j
SHA256 422748e2d2b40ec453b79da7745531cdff203bbfc37e3d775999e4fecaf250ae
MD5 4fc36db679b01d016a44ae77f4dd004a
SHA1 54f3c60fe372e909867c2d094bbe4a9168a01467
SHA512 f43f8703ca6fde9c6204dc3ecb25c179156e54aae01322813cbf6ed99ec6f6aeab2fb48fdf69e9050d8c51e4096497cb29ef973551571f5af1696a16d99576e8
SSDEEP 6144:L/EhD+rFRHoN+8UuQgKljCizbkhmvKvjE7J:YhwFRHTlXLvKw7J
TLSH
T1D0347D10B8D18032E576593649BAEF764D3EBC605B64A6CF67800DF9CE306C09B39B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-12_4fc36db679b01d016a44ae77f4dd004a_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

File Explorer

2026-11-12_4fc36db679b01d016a44ae77f4dd004a_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

.exe 242KB

2026-11-12_4fc36db679b01d016a44ae77f4dd004a_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

IMPHASH 8935b82b1fd7402b2330f654715c06dc
SHA256 422748e2d2b40ec453b79da7745531cdff203bbfc37e3d775999e4fecaf250ae
MD5 4fc36db679b01d016a44ae77f4dd004a
SHA1 54f3c60fe372e909867c2d094bbe4a9168a01467
SHA512 f43f8703ca6fde9c6204dc3ecb25c179156e54aae01322813cbf6ed99ec6f6aeab2fb48fdf69e9050d8c51e4096497cb29ef973551571f5af1696a16d99576e8
SSDEEP 6144:L/EhD+rFRHoN+8UuQgKljCizbkhmvKvjE7J:YhwFRHTlXLvKw7J
TLSH
T1D0347D10B8D18032E576593649BAEF764D3EBC605B64A6CF67800DF9CE306C09B39B5B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

253952

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

apputil32.pdb

kernel32

CreateFileW GetCurrentThreadId OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar Sleep FormatMessageW GetLastError Process32Next CloseHandle LoadLibraryW GetLocalTime GetProcAddress LocalFree VerSetConditionMask GetCurrentProcessId SystemTimeToFileTime FreeLibrary WaitForSingleObject VirtualQuery LoadLibraryExW SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead HeapSize SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation HeapReAlloc GetModuleFileNameW TerminateProcess OutputDebugStringA GetCurrentProcess GetLongPathNameW VerifyVersionInfoW Process32First GetCurrentDirectoryW FindClose FindFirstFileExW FindNextFileW GetFullPathNameW WideCharToMultiByte FormatMessageA GetLocaleInfoEx GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo RaiseException RtlUnwind SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree GetDriveTypeW ExitProcess GetModuleHandleExW GetStdHandle WriteFile IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle WriteConsoleW

user32

GetWindowThreadProcessId GetAsyncKeyState FindWindowW wsprintfW MessageBoxW PostMessageW

shell32

ShellExecuteW

advapi32

RegQueryInfoKeyW RegSetValueExW RegOpenKeyExW RegQueryValueExW RegEnumKeyExA RegCloseKey

Name

.text

Size

161KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

54KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.zero

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-12_4fc36db679b01d016a44ae77f4dd004a_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader

kernel32

user32

shell32

advapi32

generic