2026-08-04_09882cf13a0d55fba62352853a397f2d_amadey_cobalt-strike_elex_hellokitty_smoke-loader_wapomi

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_09882cf13a0d55fba62352853a397f2d_amadey_cobalt-strike_elex_hellokitty_smoke-loader_wapomi
Size 245KB
Sample260804-t98rnsan4s
SHA256 d335188a019f57b84f839eb335d01659fbac9155110ba2f228aacea2a7952e3a
MD5 09882cf13a0d55fba62352853a397f2d
SHA1 455ae115b2b21b6f0798a9cad1163998ac5194e2
SHA512 d939cef4a4c7f14c78ee4b2014983bb22c6cfbb07d817bc213c2a565ec3fedf0f9ab994fef51536d3713f5869dcf13819033369865e583c50bc1b9184931a30f
SSDEEP 3072:YZscseo49pDj9pANfgjMn0i1QTkGWqzXqhDCvbRJwacuSh/PdDEbKsLEwGrg6n25:YZED49pLAb0i+bRLohdmKsAw36n2lYJ
TLSH
T1F7347B1175C184B2E562093344A1EDB54A7EFD344F20AAEB37887B7F8A352C1DB31B66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_09882cf13a0d55fba62352853a397f2d_amadey_cobalt-strike_elex_hellokitty_smoke-loader_wapomi

File Explorer

2026-08-04_09882cf13a0d55fba62352853a397f2d_amadey_cobalt-strike_elex_hellokitty_smoke-loader_wapomi

.exe 245KB

2026-08-04_09882cf13a0d55fba62352853a397f2d_amadey_cobalt-strike_elex_hellokitty_smoke-loader_wapomi

IMPHASH 153f025dcca40e1f7e0b8d74926adf21
SHA256 d335188a019f57b84f839eb335d01659fbac9155110ba2f228aacea2a7952e3a
MD5 09882cf13a0d55fba62352853a397f2d
SHA1 455ae115b2b21b6f0798a9cad1163998ac5194e2
SHA512 d939cef4a4c7f14c78ee4b2014983bb22c6cfbb07d817bc213c2a565ec3fedf0f9ab994fef51536d3713f5869dcf13819033369865e583c50bc1b9184931a30f
SSDEEP 3072:YZscseo49pDj9pANfgjMn0i1QTkGWqzXqhDCvbRJwacuSh/PdDEbKsLEwGrg6n25:YZED49pLAb0i+bRLohdmKsAw36n2lYJ
TLSH
T1F7347B1175C184B2E562093344A1EDB54A7EFD344F20AAEB37887B7F8A352C1DB31B66
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

253952

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

shlwapi

PathRemoveBackslashW PathFileExistsW PathUnquoteSpacesW

kernel32

K32GetProcessImageFileNameW OpenProcess CreateToolhelp32Snapshot Sleep Process32NextW GetUserDefaultLCID DeleteFileW GetModuleFileNameW CloseHandle GetNativeSystemInfo LocalFree CopyFileW GetConsoleMode GetConsoleOutputCP TerminateProcess GetCommandLineW WriteConsoleW Process32FirstW UnhandledExceptionFilter FlushFileBuffers HeapReAlloc HeapSize GetProcessHeap LCMapStringW FormatMessageA CreateFileW FindClose FindFirstFileExW FindNextFileW GetFileAttributesW GetFileAttributesExW SetFileInformationByHandle SetFilePointerEx GetTempPathW AreFileApisANSI GetLastError GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte DecodePointer SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind RaiseException SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetCPInfo GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapAlloc HeapFree GetStringTypeW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType

user32

MessageBoxW

advapi32

RegDeleteKeyW RegDeleteTreeW RegOpenKeyExW RegDeleteValueW RegQueryValueExW RegCloseKey

shell32

ShellExecuteW CommandLineToArgvW ShellExecuteExW SHGetKnownFolderPath SHChangeNotify

ole32

CoTaskMemFree

Name

.text

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

119KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

16KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_09882cf13a0d55fba62352853a397f2d_amadey_cobalt-strike_elex_hellokitty_smoke-loader_wapomi

shlwapi

kernel32

user32

advapi32

shell32

ole32

generic