2026-07-18_63311d08b0a69a295c38ff5e81920504_amadey_cobalt-strike_elex_hellokitty

General

Target
2026-07-18_63311d08b0a69a295c38ff5e81920504_amadey_cobalt-strike_elex_hellokitty
Size 204KB
Sample260718-3tapdafv4m
SHA256 6321f72385c3171b531223f18a9e932e7f8794a4d68528b1194615803374f3a7
MD5 63311d08b0a69a295c38ff5e81920504
SHA1 8deb3624b4491e9780a6a0ef0fe195b55f347735
SHA512 4a44f4b31befc5c24ef893c157a522937e603800a6e5b8d35f2e09eb6a4a15a66d290a91c9a5f42a21691f0998f9a084ee0857e5f2adfe6c90ed8530da44c7c3
SSDEEP 3072:BpxD4+RhhA7W0TPYuEGfMsPiZTtlthB0Biu1eDaiB+N6LpCcu51lviIzdXfEqMl4:GI0UuEGfV6FthqBiu1eDNB+h8WH
TLSH
T163145F2133F80969F4F39E316C758F29993EFC35AE35E76E1644219E2D35A019922B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-18_63311d08b0a69a295c38ff5e81920504_amadey_cobalt-strike_elex_hellokitty

File Explorer

2026-07-18_63311d08b0a69a295c38ff5e81920504_amadey_cobalt-strike_elex_hellokitty

.exe 204KB

2026-07-18_63311d08b0a69a295c38ff5e81920504_amadey_cobalt-strike_elex_hellokitty

IMPHASH e00d60405a249a05d3b09aa7fe924b17
SHA256 6321f72385c3171b531223f18a9e932e7f8794a4d68528b1194615803374f3a7
MD5 63311d08b0a69a295c38ff5e81920504
SHA1 8deb3624b4491e9780a6a0ef0fe195b55f347735
SHA512 4a44f4b31befc5c24ef893c157a522937e603800a6e5b8d35f2e09eb6a4a15a66d290a91c9a5f42a21691f0998f9a084ee0857e5f2adfe6c90ed8530da44c7c3
SSDEEP 3072:BpxD4+RhhA7W0TPYuEGfMsPiZTtlthB0Biu1eDaiB+N6LpCcu51lviIzdXfEqMl4:GI0UuEGfV6FthqBiu1eDNB+h8WH
TLSH
T163145F2133F80969F4F39E316C758F29993EFC35AE35E76E1644219E2D35A019922B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

46610

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

MicrosoftEdgeUpdate_unsigned.pdb

kernel32

GetModuleFileNameW GetLastError CloseHandle GetProcAddress CreateProcessW FreeLibrary GetTempFileNameW LoadLibraryExW GetCommandLineW GetModuleHandleW WriteConsoleW RaiseException GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW LocalFree FormatMessageA CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle RemoveDirectoryW SetFilePointerEx AreFileApisANSI SetLastError CopyFileW MultiByteToWideChar WideCharToMultiByte InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree RtlUnwind EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetCPInfo HeapAlloc HeapFree IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode DecodePointer

ole32

CoTaskMemFree

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-18_63311d08b0a69a295c38ff5e81920504_amadey_cobalt-strike_elex_hellokitty

kernel32

ole32

generic