2026-07-11_2636e7426c0c93b7b7d20d5483ba60f3_amadey_cobalt-strike_elex_play

General

Target
2026-07-11_2636e7426c0c93b7b7d20d5483ba60f3_amadey_cobalt-strike_elex_play
Size 87KB
Sample260711-fe484sd17w
SHA256 641bf43bb381bcdf4a0a7b82ef52c6f01b54417cf8b7f7bc5a98f46a41a756ab
MD5 2636e7426c0c93b7b7d20d5483ba60f3
SHA1 10d56d2f324fecf3e0096fee68b2a88468bd146d
SHA512 bf7ae6d86d7019ab7f81100ab07c7f59c47a02a3a55d68441ff0331d409fc83c51aeb18f039fb497fb7b35a2332dc9101bdfb1abbd5e2f3b01fb2b8162d26a9c
SSDEEP 1536:bQ9TGWkmpWans31loWSVJxjXW/PFpBN25CN3ztxSzn5w2eKBAB60ysWLcdRVX+Uf:cAEpWanQ1loW8jG/PX25CNjtxSzn59By
TLSH
T150936C0274C2C471E97618715878DAA59A3EF9501F719DFB338816BA4F341C09E3AEEB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-11_2636e7426c0c93b7b7d20d5483ba60f3_amadey_cobalt-strike_elex_play

File Explorer

2026-07-11_2636e7426c0c93b7b7d20d5483ba60f3_amadey_cobalt-strike_elex_play

.exe 87KB

2026-07-11_2636e7426c0c93b7b7d20d5483ba60f3_amadey_cobalt-strike_elex_play

IMPHASH a44fab739f1eaf4e35a9d5546ec80550
SHA256 641bf43bb381bcdf4a0a7b82ef52c6f01b54417cf8b7f7bc5a98f46a41a756ab
MD5 2636e7426c0c93b7b7d20d5483ba60f3
SHA1 10d56d2f324fecf3e0096fee68b2a88468bd146d
SHA512 bf7ae6d86d7019ab7f81100ab07c7f59c47a02a3a55d68441ff0331d409fc83c51aeb18f039fb497fb7b35a2332dc9101bdfb1abbd5e2f3b01fb2b8162d26a9c
SSDEEP 1536:bQ9TGWkmpWans31loWSVJxjXW/PFpBN25CN3ztxSzn5w2eKBAB60ysWLcdRVX+Uf:cAEpWanQ1loW8jG/PX25CNjtxSzn59By
TLSH
T150936C0274C2C471E97618715878DAA59A3EF9501F719DFB338816BA4F341C09E3AEEB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

7631

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

wsprintfW

kernel32

RaiseException WriteConsoleW CreateDirectoryA CreateFileA CreateFileW DeleteFileA WriteFile CloseHandle GetLastError HeapAlloc HeapFree GetProcessHeap Sleep CreateProcessW GetTickCount GetVersionExW GetModuleFileNameW GetProcAddress LoadLibraryA CreateFileMappingA GetComputerNameW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer DecodePointer GetStdHandle ExitProcess GetModuleHandleExW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-11_2636e7426c0c93b7b7d20d5483ba60f3_amadey_cobalt-strike_elex_play

user32

kernel32

generic