2026-07-15_a1c6e73450803f22079d162b39801981_amadey_cobalt-strike_elex_hellokitty

General

Target
2026-07-15_a1c6e73450803f22079d162b39801981_amadey_cobalt-strike_elex_hellokitty
Size 95KB
Sample260715-g228psgv21
SHA256 272062e2d0c9751aeebb4004fad14704aab0c0c64494f47d1cdf938dde01d118
MD5 a1c6e73450803f22079d162b39801981
SHA1 be63e8cbb88f2b33b192e5366bfba6254ea58edc
SHA512 bbc61359d9382730eaae50921a691eebe32a0aeac2d797b4bec2fd040e69549d6d861ff48b6d82a5724404e1a6628776fbc4958ef2bb11a51a14e09496ca18f6
SSDEEP 1536:zWszC9YLGKgJej+lKeXbP9+6245IgQ2ZRDv8F2WWLwh2W8Nq1ssWh0ScdFclveCX:zWssYL8J4deLPKgQ2Zdv82L0QqE0TFcp
TLSH
T1CFA35A1275D1C4B1D5761A321874AEB58B3DFD304FA19DAB27A40A7E4F302C29E32D6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-15_a1c6e73450803f22079d162b39801981_amadey_cobalt-strike_elex_hellokitty

File Explorer

2026-07-15_a1c6e73450803f22079d162b39801981_amadey_cobalt-strike_elex_hellokitty

.exe 95KB

2026-07-15_a1c6e73450803f22079d162b39801981_amadey_cobalt-strike_elex_hellokitty

IMPHASH 5b516061dc6c9bf0cead53c398b8026b
SHA256 272062e2d0c9751aeebb4004fad14704aab0c0c64494f47d1cdf938dde01d118
MD5 a1c6e73450803f22079d162b39801981
SHA1 be63e8cbb88f2b33b192e5366bfba6254ea58edc
SHA512 bbc61359d9382730eaae50921a691eebe32a0aeac2d797b4bec2fd040e69549d6d861ff48b6d82a5724404e1a6628776fbc4958ef2bb11a51a14e09496ca18f6
SSDEEP 1536:zWszC9YLGKgJej+lKeXbP9+6245IgQ2ZRDv8F2WWLwh2W8Nq1ssWh0ScdFclveCX:zWssYL8J4deLPKgQ2Zdv82L0QqE0TFcp
TLSH
T1CFA35A1275D1C4B1D5761A321874AEB58B3DFD304FA19DAB27A40A7E4F302C29E32D6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

12790

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

M:\Program\bypassuac\Release\bypassuac.pdb

kernel32

Sleep CreateProcessW WaitForSingleObject GetSystemDirectoryW GetCurrentThread lstrcmpW ConnectNamedPipe ReadFile DisconnectNamedPipe MultiByteToWideChar WriteConsoleW lstrcatW GetWindowsDirectoryW GetModuleFileNameW GetCommandLineW GetLastError CreateMutexW CloseHandle OpenProcess GetProcAddress LoadLibraryW CreateNamedPipeW GetCurrentProcessId CreateFileW SetFilePointerEx GetConsoleMode GetConsoleOutputCP UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind RaiseException SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetCommandLineA HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW CompareStringW LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers DecodePointer

advapi32

CloseServiceHandle CreateServiceW OpenSCManagerW RevertToSelf CreateProcessAsUserW CreateProcessWithTokenW ImpersonateNamedPipeClient AdjustTokenPrivileges LookupPrivilegeValueW DuplicateTokenEx OpenThreadToken

shell32

CommandLineToArgvW

ole32

CoInitializeEx IIDFromString CoGetObject

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-15_a1c6e73450803f22079d162b39801981_amadey_cobalt-strike_elex_hellokitty

kernel32

advapi32

shell32

ole32

generic