2026-11-11_5357eedb2c22cfdfff353ac80d04d299_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-11_5357eedb2c22cfdfff353ac80d04d299_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader
Size 268KB
Sample261113-pgvbcsbv2y
SHA256 d985fe67ebb829efe72d0f906cd2e3849830a07be46e487214283cfc93c6b06a
MD5 5357eedb2c22cfdfff353ac80d04d299
SHA1 243bf1a39403e334bbf18c0db705de1860314f14
SHA512 2d9ac384c257cd4fe7023af22176b6dd496a070aab95300ff3b4d9a4e128ed52f150967a711f17bc8665df45a8f08a02506308b349bf43b8af67def7712435aa
SSDEEP 6144:OMtqSya7IdLRUSZmRi1Qye6AO/ebGwI4fx+U+FfFyVHrlIV5g:ptqSya7IdLRrZmRz6FeKwBx+UafFyVHn
TLSH
T1E044BF12B5D5C0B3E973093049F4AE759ABDB9310B118A7F63D88F6E1F31682D21A763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-11_5357eedb2c22cfdfff353ac80d04d299_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader

File Explorer

2026-11-11_5357eedb2c22cfdfff353ac80d04d299_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader

.exe 268KB

2026-11-11_5357eedb2c22cfdfff353ac80d04d299_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader

IMPHASH 732feb8782b8954daf041312c4414b7a
SHA256 d985fe67ebb829efe72d0f906cd2e3849830a07be46e487214283cfc93c6b06a
MD5 5357eedb2c22cfdfff353ac80d04d299
SHA1 243bf1a39403e334bbf18c0db705de1860314f14
SHA512 2d9ac384c257cd4fe7023af22176b6dd496a070aab95300ff3b4d9a4e128ed52f150967a711f17bc8665df45a8f08a02506308b349bf43b8af67def7712435aa
SSDEEP 6144:OMtqSya7IdLRUSZmRi1Qye6AO/ebGwI4fx+U+FfFyVHrlIV5g:ptqSya7IdLRrZmRz6FeKwBx+UafFyVHn
TLSH
T1E044BF12B5D5C0B3E973093049F4AE759ABDB9310B118A7F63D88F6E1F31682D21A763
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

44052

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

GoogleUpdateCore_unsigned.pdb

kernel32

GetModuleHandleW GetProcAddress GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RtlUnwind EncodePointer ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCurrentThread FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW RaiseException LCMapStringW GetFileType SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW WriteConsoleW SizeofResource LockResource FindResourceExW LoadResource FindResourceW lstrlenW lstrcmpiW WaitForSingleObject ReleaseMutex GetFileAttributesExW GetTickCount CreateProcessW TryEnterCriticalSection InitializeCriticalSection CreateMutexW Sleep GetEnvironmentVariableW GetSystemDirectoryW VirtualQuery CreateDirectoryW SetFilePointer MoveFileExW GetPrivateProfileIntW OutputDebugStringA GetFileInformationByHandle GetLocalTime lstrcmpW GetVersionExW VerSetConditionMask VerifyVersionInfoW lstrcpynW GlobalAlloc GlobalFree GlobalLock GlobalUnlock VirtualProtect VirtualAlloc GetSystemInfo CloseHandle HeapReAlloc GetLastError HeapSize InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsW HeapFree

ole32

StringFromGUID2 CoInitializeEx CoUninitialize IIDFromString

user32

wvsprintfW MessageBoxW SetClipboardData EmptyClipboard CloseClipboard OpenClipboard CharUpperW CharLowerW wsprintfW

advapi32

TraceEvent GetTraceLoggerHandle GetTraceEnableFlags GetTraceEnableLevel RegisterTraceGuidsW UnregisterTraceGuids RegQueryValueExW RegEnumValueW RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegQueryInfoKeyW RegCloseKey GetTokenInformation MakeAbsoluteSD MakeSelfRelativeSD OpenThreadToken GetSecurityDescriptorLength GetLengthSid InitializeAcl InitializeSecurityDescriptor OpenProcessToken AddAce IsValidSid ImpersonateLoggedOnUser GetSecurityDescriptorOwner InitializeSid CopySid GetSecurityDescriptorControl SetNamedSecurityInfoW GetSidLengthRequired GetSidSubAuthority GetSecurityDescriptorGroup EqualSid GetAclInformation GetSecurityDescriptorDacl RevertToSelf SetSecurityDescriptorDacl GetSecurityDescriptorSacl

shell32

SHGetFolderPathW

netapi32

NetApiBufferFree NetGetJoinInformation

shlwapi

PathRemoveFileSpecW PathCanonicalizeW PathRemoveExtensionW PathAppendW SHQueryValueExW PathStripPathW

userenv

UnloadUserProfile

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-11_5357eedb2c22cfdfff353ac80d04d299_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader

kernel32

ole32

user32

advapi32

shell32

netapi32

shlwapi

userenv

version

generic