2026-06-27_f7d36dfd04ec15835613384698580a51_akira_amadey_cobalt-strike_elex_glassworm

General

Target
2026-06-27_f7d36dfd04ec15835613384698580a51_akira_amadey_cobalt-strike_elex_glassworm
Size 415KB
Sample260629-bkhvvaa19n
SHA256 a754a7b01ca5942c5da6bd1cc770fae202b41780fdd036b444b30085e5ee6845
MD5 f7d36dfd04ec15835613384698580a51
SHA1 f901f14eb1cde1414cb9924b75cc6649708eb2b0
SHA512 ec1c5522bdd5c444a56581ed45f9bc4e3131f97440c44d1df1ffb7573da2d4464fc74e5da3d9012ed196c11da153d5c96ae015a6a59cf38593093ef482bb5acd
SSDEEP 6144:h5Y1XKgET26grcJIVyX+GVthSAiZ1JBLcVXOgKdAr+XPDvEhpHSvdytm:MXQTVgAmV2+QJiFBwOo+/ghp2dim
TLSH
T1DF94F101BCF199B2C5AB80710C38D7A84A3E69100F11CDEBABE45D35DF753E15B35AAA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-27_f7d36dfd04ec15835613384698580a51_akira_amadey_cobalt-strike_elex_glassworm

File Explorer

2026-06-27_f7d36dfd04ec15835613384698580a51_akira_amadey_cobalt-strike_elex_glassworm

.exe 415KB

2026-06-27_f7d36dfd04ec15835613384698580a51_akira_amadey_cobalt-strike_elex_glassworm

IMPHASH 800a0432b17adad30c7306eebe378444
SHA256 a754a7b01ca5942c5da6bd1cc770fae202b41780fdd036b444b30085e5ee6845
MD5 f7d36dfd04ec15835613384698580a51
SHA1 f901f14eb1cde1414cb9924b75cc6649708eb2b0
SHA512 ec1c5522bdd5c444a56581ed45f9bc4e3131f97440c44d1df1ffb7573da2d4464fc74e5da3d9012ed196c11da153d5c96ae015a6a59cf38593093ef482bb5acd
SSDEEP 6144:h5Y1XKgET26grcJIVyX+GVthSAiZ1JBLcVXOgKdAr+XPDvEhpHSvdytm:MXQTVgAmV2+QJiFBwOo+/ghp2dim
TLSH
T1DF94F101BCF199B2C5AB80710C38D7A84A3E69100F11CDEBABE45D35DF753E15B35AAA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

90226

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

kernel32

RtlUnwind CreateFileW LoadLibraryA GetProcAddress VirtualProtect HeapCreate HeapAlloc AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetProcessHeap HeapFree HeapReAlloc GetCurrentThreadId GetLastError SetLastError GetEnvironmentVariableW GetCurrentDirectoryW GetCurrentProcess RtlCaptureContext ReleaseMutex WaitForSingleObjectEx lstrlenW GetCurrentProcessId CreateMutexA CloseHandle WideCharToMultiByte GetStdHandle GetConsoleMode GetConsoleOutputCP WaitForSingleObject MultiByteToWideChar WriteConsoleW GetModuleHandleA GetModuleHandleW FormatMessageW SetFilePointerEx FlushFileBuffers HeapSize QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess DecodePointer EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RaiseException WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW CompareStringW LCMapStringW

ntdll

NtWriteFile RtlNtStatusToDosError

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-27_f7d36dfd04ec15835613384698580a51_akira_amadey_cobalt-strike_elex_glassworm

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

generic