2026-07-15_96a2085b6422fe39c553ba9ae3107fcd_amadey_cobalt-strike_elex_hellokitty

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-15_96a2085b6422fe39c553ba9ae3107fcd_amadey_cobalt-strike_elex_hellokitty
Size 151KB
Sample260715-e68j6sbx4m
SHA256 dfa243df88361dddaaf9a81b1ea4ca3762b95de4fc5474ef9bd5a084ff0ed8ff
MD5 96a2085b6422fe39c553ba9ae3107fcd
SHA1 3e8efa29fc4340e37af91812f5be4c85d793f8eb
SHA512 b4b9f046d355676221dc874e5c09954e9bf67117e54367088f0681cc8de519d5d88478333b149260ef7660982d7fed01acc268a95faedbf359a450683f87e950
SSDEEP 3072:bubMIaehBOB+IjxwVq8rYL+/pPQJR5/m2auqhpif+YP:qozeXOBHwY8rYLnJvmQq/if+YP
TLSH
T1DBE37C1136C08072E67315396868CB71DD3EF9204E6A9F6B7394077E9F702D0AE74A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-15_96a2085b6422fe39c553ba9ae3107fcd_amadey_cobalt-strike_elex_hellokitty

File Explorer

2026-07-15_96a2085b6422fe39c553ba9ae3107fcd_amadey_cobalt-strike_elex_hellokitty

.exe 151KB

2026-07-15_96a2085b6422fe39c553ba9ae3107fcd_amadey_cobalt-strike_elex_hellokitty

IMPHASH 447396ee53fb9c49711cb6df6205591f
SHA256 dfa243df88361dddaaf9a81b1ea4ca3762b95de4fc5474ef9bd5a084ff0ed8ff
MD5 96a2085b6422fe39c553ba9ae3107fcd
SHA1 3e8efa29fc4340e37af91812f5be4c85d793f8eb
SHA512 b4b9f046d355676221dc874e5c09954e9bf67117e54367088f0681cc8de519d5d88478333b149260ef7660982d7fed01acc268a95faedbf359a450683f87e950
SSDEEP 3072:bubMIaehBOB+IjxwVq8rYL+/pPQJR5/m2auqhpif+YP:qozeXOBHwY8rYLnJvmQq/if+YP
TLSH
T1DBE37C1136C08072E67315396868CB71DD3EF9204E6A9F6B7394077E9F702D0AE74A6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4823

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

aslib

MEDV TIME IOTYX MPYVP A23A1 A3A1 DECOD EDFILL EDMM_M EDMNTH EDORDR TPDIV

clibwin

EXEC FIND_PROCESS IOTY PROCESS_MEMORY_CLOSE PROCESS_MEMORY_OPEN PROCESS_MEMORY_READ VAXEXEC EXITST OMLOG WAIT zinitc

kernel32

GetProcAddress WriteConsoleW CloseHandle CreateFileW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize GetProcessHeap LCMapStringW CompareStringW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW GetCurrentProcess TerminateProcess GetStringTypeW GetFileType RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary DecodePointer LoadLibraryExW EncodePointer RaiseException GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle

Name

.text

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Z_TEXT

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

string_T

Size

512B

Virtual Size

284B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_IDIV_TE

Size

512B

Virtual Size

106B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

equs_TEX

Size

512B

Virtual Size

10B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

zinit_TE

Size

512B

Virtual Size

118B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

divds_TE

Size

512B

Virtual Size

13B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_ZDATA

Size

41KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

752B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-15_96a2085b6422fe39c553ba9ae3107fcd_amadey_cobalt-strike_elex_hellokitty

aslib

clibwin

kernel32

generic