2026-08-01_3ee2ff9322d5b5b8dc900e01c3474b58_amadey_cobalt-strike_elex_play

General

Target
2026-08-01_3ee2ff9322d5b5b8dc900e01c3474b58_amadey_cobalt-strike_elex_play
Size 716KB
Sample260801-1frdvsgp3v
SHA256 8ea36454562543ff5fe7ddf03916a0dc5b3264ee97ea595a82948f79f6a1cd23
MD5 3ee2ff9322d5b5b8dc900e01c3474b58
SHA1 8288c4382719c6acda3e39cff853c6e46e363674
SHA512 cef0640ead678b0b140b6ff0bf54df474752d026612d221da00236947b84e4fdd047bafe2d6a648e0590d9547ee7206f5acc09abb1c63e77ddf1c645a85b2f92
SSDEEP 12288:NTP/aK2vB+MWG4cpoLNWr3dLgiIftUyn32JSwvKKCpjjgOjxVOdTTzZif608Jfm2:NLCKABlWupeuLgiImynGQyQvg2nqX26v
TLSH
T1C8F4F01637F812ADF1B36B34A8755B519ABAFC32DD20DB7E1680166D0E31980DA11F37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_3ee2ff9322d5b5b8dc900e01c3474b58_amadey_cobalt-strike_elex_play

File Explorer

2026-08-01_3ee2ff9322d5b5b8dc900e01c3474b58_amadey_cobalt-strike_elex_play

.exe 716KB

2026-08-01_3ee2ff9322d5b5b8dc900e01c3474b58_amadey_cobalt-strike_elex_play

IMPHASH b696542cade53789c2cbed09ce287013
SHA256 8ea36454562543ff5fe7ddf03916a0dc5b3264ee97ea595a82948f79f6a1cd23
MD5 3ee2ff9322d5b5b8dc900e01c3474b58
SHA1 8288c4382719c6acda3e39cff853c6e46e363674
SHA512 cef0640ead678b0b140b6ff0bf54df474752d026612d221da00236947b84e4fdd047bafe2d6a648e0590d9547ee7206f5acc09abb1c63e77ddf1c645a85b2f92
SSDEEP 12288:NTP/aK2vB+MWG4cpoLNWr3dLgiIftUyn32JSwvKKCpjjgOjxVOdTTzZif608Jfm2:NLCKABlWupeuLgiImynGQyQvg2nqX26v
TLSH
T1C8F4F01637F812ADF1B36B34A8755B519ABAFC32DD20DB7E1680166D0E31980DA11F37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

30034

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

GoogleUpdate_unsigned.pdb

advapi32

RegOpenKeyExW

kernel32

SizeofResource HeapFree GetCommandLineW GetModuleFileNameW InitializeCriticalSectionAndSpinCount HeapSize GetLastError GetFileAttributesExW LockResource HeapReAlloc RaiseException FindResourceExW LoadResource FindResourceW HeapAlloc DecodePointer HeapDestroy GetProcAddress DeleteCriticalSection GetProcessHeap GetModuleHandleW FreeLibrary LoadLibraryExW CloseHandle CreateFileW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetStringTypeW SetStdHandle IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree RtlUnwind EncodePointer ExitProcess GetModuleHandleExW GetStdHandle WriteFile FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW GetFileType WriteConsoleW

shell32

SHGetFolderPathW

user32

CharLowerBuffW

shlwapi

SHQueryValueExW PathAppendW PathRemoveFileSpecW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_3ee2ff9322d5b5b8dc900e01c3474b58_amadey_cobalt-strike_elex_play

advapi32

kernel32

shell32

user32

shlwapi

generic