play | 2026-03-16_509bae9d41213a0181f17230f6472d81_amadey_elex_play

General

Target
2026-03-16_509bae9d41213a0181f17230f6472d81_amadey_elex_play
Size 178KB
Sample260316-b129esav4t
SHA256 e3825b90dc5c5cb7d8eca6e25ce381560a801af7c0759a4061c1192ae838f66d
MD5 509bae9d41213a0181f17230f6472d81
SHA1 02948eb238c7817986e51e939f8a162cea4caf53
SHA512 0cae0ab660dac173c3fddfa0dbfa7e363ee0ab60adbcc15b68f9497516c6407c5013a94c5ee77c05eb00187369dbd765b02fa1ee2a1e8bffbab57ed8618b9a12
SSDEEP 3072:srl2uRkddO+zyyR7OZOQIdzeIP9mwUGU3l2bxW1/9JnOt/fhKJ2mhB/mG:a2uyrOhUg8U12K9dIEvB/7
TLSH
T126045B15B7F1D0B5D876057426E99EF1CE2C39310B01C8EB67901B6969306E2E13BBBB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

ransomware play

Play ransomware payload 1 IoCs

ransomware

resource	yara_rule
sample	family_play

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-03-16_509bae9d41213a0181f17230f6472d81_amadey_elex_play

IMPHASH bfaffd974eb97f13ae5b4b98aa20c81e
SHA256 e3825b90dc5c5cb7d8eca6e25ce381560a801af7c0759a4061c1192ae838f66d
MD5 509bae9d41213a0181f17230f6472d81
SHA1 02948eb238c7817986e51e939f8a162cea4caf53
SHA512 0cae0ab660dac173c3fddfa0dbfa7e363ee0ab60adbcc15b68f9497516c6407c5013a94c5ee77c05eb00187369dbd765b02fa1ee2a1e8bffbab57ed8618b9a12
SSDEEP 3072:srl2uRkddO+zyyR7OZOQIdzeIP9mwUGU3l2bxW1/9JnOt/fhKJ2mhB/mG:a2uyrOhUg8U12K9dIEvB/7
TLSH
T126045B15B7F1D0B5D876057426E99EF1CE2C39310B01C8EB67901B6969306E2E13BBBB
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

6

Entry point

97955

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths