2026-07-12_5f82d0b3fcec715f061c66e69bcd805b_amadey_cobalt-strike_elex_smoke-loader

General

Target
2026-07-12_5f82d0b3fcec715f061c66e69bcd805b_amadey_cobalt-strike_elex_smoke-loader
Size 201KB
Sample260712-qavtzsct21
SHA256 d61c047a9221150811d80bf2e941328c8e58ececaea2ba19a51c60b446311583
MD5 5f82d0b3fcec715f061c66e69bcd805b
SHA1 ab28b124ed537839a4e52c845689bfad7773bf79
SHA512 4d6ecee8c68cc19443c211ab61f20765489967a631fb05ea96d3590ff36f137f8cad2d38748d2ae1001e2a5ada830d8a4f2455be3b8c9f3d42f92d91f8edd1b4
SSDEEP 6144:3qz4ebTew3m6utfDcA5zBNiKUwIuqnSPc51tAOybeaB:Bw3m6uVgQBgHuqnSPEjYVB
TLSH
T19B148D00B4D2C872E87215301AF4EF754A7DB9158B64ADEF63940B7D4F307C39636AAA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-12_5f82d0b3fcec715f061c66e69bcd805b_amadey_cobalt-strike_elex_smoke-loader

File Explorer

2026-07-12_5f82d0b3fcec715f061c66e69bcd805b_amadey_cobalt-strike_elex_smoke-loader

.exe 201KB

2026-07-12_5f82d0b3fcec715f061c66e69bcd805b_amadey_cobalt-strike_elex_smoke-loader

IMPHASH 58d90d8fc852ba445ffae0efadc56f75
SHA256 d61c047a9221150811d80bf2e941328c8e58ececaea2ba19a51c60b446311583
MD5 5f82d0b3fcec715f061c66e69bcd805b
SHA1 ab28b124ed537839a4e52c845689bfad7773bf79
SHA512 4d6ecee8c68cc19443c211ab61f20765489967a631fb05ea96d3590ff36f137f8cad2d38748d2ae1001e2a5ada830d8a4f2455be3b8c9f3d42f92d91f8edd1b4
SSDEEP 6144:3qz4ebTew3m6utfDcA5zBNiKUwIuqnSPc51tAOybeaB:Bw3m6uVgQBgHuqnSPEjYVB
TLSH
T19B148D00B4D2C872E87215301AF4EF754A7DB9158B64ADEF63940B7D4F307C39636AAA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

212992

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\dev\we\build\make\x86\applicationwallpaperinject\Release\applicationwallpaperinject32.pdb

kernel32

GetLastError CloseHandle GetCurrentDirectoryW GetProcAddress VirtualAllocEx GetModuleHandleW WideCharToMultiByte CreateRemoteThread QueryPerformanceCounter MultiByteToWideChar GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess WriteConsoleW OpenProcess GetCurrentProcess GetCurrentProcessId WriteProcessMemory GetStringTypeW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LCMapStringW GetLocaleInfoW GetCPInfo RaiseException RtlUnwind FreeLibrary LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetFileSizeEx SetFilePointerEx GetFileType FlushFileBuffers GetConsoleCP GetConsoleMode HeapFree HeapAlloc IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile ReadConsoleW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap HeapReAlloc HeapSize CreateFileW SetEndOfFile

advapi32

AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-12_5f82d0b3fcec715f061c66e69bcd805b_amadey_cobalt-strike_elex_smoke-loader

kernel32

advapi32

generic