2026-07-06_08ebf0afbb82600f03ab491867c0bfd4_amadey_cobalt-strike_elex_floxif_play

General

Target
2026-07-06_08ebf0afbb82600f03ab491867c0bfd4_amadey_cobalt-strike_elex_floxif_play
Size 80KB
Sample260706-2qd2ysas2n
SHA256 0d8f01d0a8a798ec341a508beca3193e310ba87082ecee04256f9e82aa85d639
MD5 08ebf0afbb82600f03ab491867c0bfd4
SHA1 f26c9461a903d6f33306b306f4236e5a4b67d12a
SHA512 833cda27f689f6589b0a0f2779801f16d5c9b9e466469375b8e64bfdc5c90ee71002683664300c9582f71179c32bc50bb9a33ada0ef2dec796563011f96c0c58
SSDEEP 1536:PWce1vF9AkDQx8uWOJTQxwed39mQamHuDMD4BsWaIwFocdiLcIi2Q6nR:S1vF9AYw5WkTQxwCaeDbDFpiQI46nR
TLSH
T14383590376C19031E576493204B4AAA29A3FF8395FAE9E7BB78406694F301D0DE35E77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-06_08ebf0afbb82600f03ab491867c0bfd4_amadey_cobalt-strike_elex_floxif_play

File Explorer

2026-07-06_08ebf0afbb82600f03ab491867c0bfd4_amadey_cobalt-strike_elex_floxif_play

.exe 80KB

2026-07-06_08ebf0afbb82600f03ab491867c0bfd4_amadey_cobalt-strike_elex_floxif_play

IMPHASH 9643c9e4303228fdfd223cc806c6f906
SHA256 0d8f01d0a8a798ec341a508beca3193e310ba87082ecee04256f9e82aa85d639
MD5 08ebf0afbb82600f03ab491867c0bfd4
SHA1 f26c9461a903d6f33306b306f4236e5a4b67d12a
SHA512 833cda27f689f6589b0a0f2779801f16d5c9b9e466469375b8e64bfdc5c90ee71002683664300c9582f71179c32bc50bb9a33ada0ef2dec796563011f96c0c58
SSDEEP 1536:PWce1vF9AkDQx8uWOJTQxwed39mQamHuDMD4BsWaIwFocdiLcIi2Q6nR:S1vF9AYw5WkTQxwCaeDbDFpiQI46nR
TLSH
T14383590376C19031E576493204B4AAA29A3FF8395FAE9E7BB78406694F301D0DE35E77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

5179

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle CreateFileW SetFilePointerEx WriteConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize GetProcessHeap LoadLibraryW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW GetCurrentProcess TerminateProcess RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW LCMapStringW DecodePointer

comctl32

ord17

user32

GetWindowRect SetWindowTextW GetDlgItem EndDialog DialogBoxParamW ScreenToClient SetWindowPos ShowWindow DestroyWindow PostQuitMessage SendMessageW CreateDialogParamW

gdi32

CreateBrushIndirect

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-06_08ebf0afbb82600f03ab491867c0bfd4_amadey_cobalt-strike_elex_floxif_play

kernel32

comctl32

user32

gdi32

generic