2026-06-05_be5e0bbb659dd212eaba0f8e867442bf_amadey_cobalt-strike_elex_play

General

Target
2026-06-05_be5e0bbb659dd212eaba0f8e867442bf_amadey_cobalt-strike_elex_play
Size 84KB
Sample260605-mb3pfaex5k
SHA256 ac09089f7a1ff5a63255c874757c5f520429c444d78d9aec0647cd3d620b34df
MD5 be5e0bbb659dd212eaba0f8e867442bf
SHA1 1cb4861ce2c118d1d579cd7405397df7d9eeb566
SHA512 d5130a28a01e551409ecdb6bef66e5f5576fdc7e527786232ab006337875ab4a3024b19e2ac0b4d1ec2ca6d204c4c2fef1af4d84ee41b171651ef674a91060ad
SSDEEP 1536:QMkegsEmkGxBHHRH6roz/UqI/FsRNDBSG8tt/vDLnx8UlHrsWWVEcdxz4UhJCB8p:NgTz0BHHh60UqI/mDBSJtt/vvxHlUDxo
TLSH
T140834B42B5D1C471E476193258B89AB19B3EFD501F219EEB3788066B4F342C0DE35EAB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-05_be5e0bbb659dd212eaba0f8e867442bf_amadey_cobalt-strike_elex_play

File Explorer

2026-06-05_be5e0bbb659dd212eaba0f8e867442bf_amadey_cobalt-strike_elex_play

.exe 84KB

2026-06-05_be5e0bbb659dd212eaba0f8e867442bf_amadey_cobalt-strike_elex_play

IMPHASH dc0b9ecff27e02556435309576bac26a
SHA256 ac09089f7a1ff5a63255c874757c5f520429c444d78d9aec0647cd3d620b34df
MD5 be5e0bbb659dd212eaba0f8e867442bf
SHA1 1cb4861ce2c118d1d579cd7405397df7d9eeb566
SHA512 d5130a28a01e551409ecdb6bef66e5f5576fdc7e527786232ab006337875ab4a3024b19e2ac0b4d1ec2ca6d204c4c2fef1af4d84ee41b171651ef674a91060ad
SSDEEP 1536:QMkegsEmkGxBHHRH6roz/UqI/FsRNDBSG8tt/vDLnx8UlHrsWWVEcdxz4UhJCB8p:NgTz0BHHh60UqI/mDBSJtt/vvxHlUDxo
TLSH
T140834B42B5D1C471E476193258B89AB19B3EFD501F219EEB3788066B4F342C0DE35EAB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

5182

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle CreateFileW SetFilePointerEx WriteConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize GetProcessHeap LoadLibraryW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW IsProcessorFeaturePresent RtlUnwind GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer RaiseException GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW VirtualProtect LoadLibraryExW LCMapStringW DecodePointer

comctl32

ord17

user32

GetWindowRect SetWindowTextW GetDlgItem EndDialog DialogBoxParamW ScreenToClient SetWindowPos ShowWindow DestroyWindow PostQuitMessage SendMessageW CreateDialogParamW

gdi32

CreateBrushIndirect

Name

.text

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-05_be5e0bbb659dd212eaba0f8e867442bf_amadey_cobalt-strike_elex_play

kernel32

comctl32

user32

gdi32

generic