2026-06-27_98bde5aff60204ab8390b5ff9eaebe8a_amadey_cobalt-strike_elex_play

General

Target
2026-06-27_98bde5aff60204ab8390b5ff9eaebe8a_amadey_cobalt-strike_elex_play
Size 716KB
Sample260629-ffls6aew5l
SHA256 f59029ad6351216bc8cf72449b75a7c8106d49b45e42b250252e3bd6af6fa2a8
MD5 98bde5aff60204ab8390b5ff9eaebe8a
SHA1 2c1c2692f2db151309639ca15d281f959edcdd9a
SHA512 a54d4091b3fcc541d998c8af7b3992843091dec0abe4888e959f716dff426506e91a9a51ae82619895e38a4bc803f6ae9789b033eec3bfec6dbdef611c6e9bb1
SSDEEP 12288:m3P/aK2vB+VeEMPsxjVgnoYtkZzTpALzKKGq6bpaV8lXalXD4ZEo+2UZIFU0DzlD:m/CKABbE0wjVovU3pQzFubpoa81o5UZN
TLSH
T14FF4F01673F8516DF0F39B30A9759B915A79FC72EE209B7F16801A6D0E30880DA21B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-27_98bde5aff60204ab8390b5ff9eaebe8a_amadey_cobalt-strike_elex_play

File Explorer

2026-06-27_98bde5aff60204ab8390b5ff9eaebe8a_amadey_cobalt-strike_elex_play

.exe 716KB

2026-06-27_98bde5aff60204ab8390b5ff9eaebe8a_amadey_cobalt-strike_elex_play

IMPHASH b696542cade53789c2cbed09ce287013
SHA256 f59029ad6351216bc8cf72449b75a7c8106d49b45e42b250252e3bd6af6fa2a8
MD5 98bde5aff60204ab8390b5ff9eaebe8a
SHA1 2c1c2692f2db151309639ca15d281f959edcdd9a
SHA512 a54d4091b3fcc541d998c8af7b3992843091dec0abe4888e959f716dff426506e91a9a51ae82619895e38a4bc803f6ae9789b033eec3bfec6dbdef611c6e9bb1
SSDEEP 12288:m3P/aK2vB+VeEMPsxjVgnoYtkZzTpALzKKGq6bpaV8lXalXD4ZEo+2UZIFU0DzlD:m/CKABbE0wjVovU3pQzFubpoa81o5UZN
TLSH
T14FF4F01673F8516DF0F39B30A9759B915A79FC72EE209B7F16801A6D0E30880DA21B77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

30034

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

GoogleUpdate_unsigned.pdb

advapi32

RegOpenKeyExW

kernel32

SizeofResource HeapFree GetCommandLineW GetModuleFileNameW InitializeCriticalSectionAndSpinCount HeapSize GetLastError GetFileAttributesExW LockResource HeapReAlloc RaiseException FindResourceExW LoadResource FindResourceW HeapAlloc DecodePointer HeapDestroy GetProcAddress DeleteCriticalSection GetProcessHeap GetModuleHandleW FreeLibrary LoadLibraryExW CloseHandle CreateFileW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetStringTypeW SetStdHandle IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree RtlUnwind EncodePointer ExitProcess GetModuleHandleExW GetStdHandle WriteFile FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW GetFileType WriteConsoleW

shell32

SHGetFolderPathW

user32

CharLowerBuffW

shlwapi

SHQueryValueExW PathAppendW PathRemoveFileSpecW

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-27_98bde5aff60204ab8390b5ff9eaebe8a_amadey_cobalt-strike_elex_play

advapi32

kernel32

shell32

user32

shlwapi

generic