2026-07-19_f8985ca3b4c1929307552b7992759e6d_amadey_cobalt-strike_elex_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-19_f8985ca3b4c1929307552b7992759e6d_amadey_cobalt-strike_elex_smoke-loader
Size 222KB
Sample260719-y86cdaev2v
SHA256 59ba80ab41c2fe63cd40858f0f47daeaaf3f814f73d1c4dbd828d3cd97354901
MD5 f8985ca3b4c1929307552b7992759e6d
SHA1 abc37ff8ca32d6446dc115dda33e2cdb670888f1
SHA512 b2217fb879de671e5d274aaec777f32ad7c8d2d2df0df147ce27780e43f7aed4029f9572a04cca37882d9426a47494b511dd70fb8f4c24a186b5cb921258769d
SSDEEP 6144:wZzvhs2Z4n1E7g34XtVYAOfTdeDaU+nK6:wJ+2Z4nShVY5FU+nH
TLSH
T118245B5174C28072E5B20E3004F4AEB4557FFEB11E64BE6BAB94772A1F721C26631E63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
2026-07-19_f8985ca3b4c1929307552b7992759e6d_amadey_cobalt-strike_elex_smoke-loader

File Explorer

2026-07-19_f8985ca3b4c1929307552b7992759e6d_amadey_cobalt-strike_elex_smoke-loader

.exe 222KB

2026-07-19_f8985ca3b4c1929307552b7992759e6d_amadey_cobalt-strike_elex_smoke-loader

IMPHASH a99648a4d417f4130faca9d4625edb8e
SHA256 59ba80ab41c2fe63cd40858f0f47daeaaf3f814f73d1c4dbd828d3cd97354901
MD5 f8985ca3b4c1929307552b7992759e6d
SHA1 abc37ff8ca32d6446dc115dda33e2cdb670888f1
SHA512 b2217fb879de671e5d274aaec777f32ad7c8d2d2df0df147ce27780e43f7aed4029f9572a04cca37882d9426a47494b511dd70fb8f4c24a186b5cb921258769d
SSDEEP 6144:wZzvhs2Z4n1E7g34XtVYAOfTdeDaU+nK6:wJ+2Z4nShVY5FU+nH
TLSH
T118245B5174C28072E5B20E3004F4AEB4557FFEB11E64BE6BAB94772A1F721C26631E63
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

bd:9b:37:74:9a:05:c1:33:ca:27:08:ec:0e:f9:58:c9:46:c1:3a:4b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=CREDITSIGHTS LIMITED,O=CREDITSIGHTS LIMITED,L=London,C=GB

Chains

Feb 24, 2026

CN=CREDITSIGHTS LIMITED,O=CREDITSIGHTS LIMITED,L=London,C=GB

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=CREDITSIGHTS LIMITED,O=CREDITSIGHTS LIMITED,L=London,C=GB

Serial Number

0b:16:c5:f6:e1:9a:9f:a8:af:d0:02:7c:0d:df:81:08

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 30, 2025 - Jan 29, 2027

Minor OS version

Major OS version

Entry point

34859

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\ani\code\squirrel\squirrel.windows\build\Release\Win32\StubExecutable.pdb

kernel32

GetModuleFileNameW GetModuleHandleW FindFirstFileW FindNextFileW FindClose CreateProcessW CreateFileW CloseHandle WideCharToMultiByte GetLastError MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetProcAddress EnterCriticalSection LeaveCriticalSection DeleteCriticalSection LCMapStringW GetLocaleInfoW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwind RaiseException FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile HeapFree HeapAlloc IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle SetFilePointerEx HeapSize FlushFileBuffers GetConsoleCP GetConsoleMode WriteConsoleW

user32

AllowSetForegroundWindow WaitForInputIdle

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-19_f8985ca3b4c1929307552b7992759e6d_amadey_cobalt-strike_elex_smoke-loader

kernel32

user32

generic