General
- Target 2026-08-07_60c7843726f6fc813aab734ae070864c_amadey_cobalt-strike_elex_feodo_qilin
- Size 186KB
- Sample260808-bngf7axcle
- SHA256 158f151b7a33703789990ffd3b69b8e25f99db322c801f3c2a0062f6221e6635
- MD5 60c7843726f6fc813aab734ae070864c
- SHA1 00e9f85cbc5d82d8f07bc9a12c25c2852ff43210
- SHA512 8588c9b89822faadb3b476d1c40a652fe2bfe17f2be0f1f0b897a6863981dece0495036f2b10d5af216be40cc847475456a33b6b09b832f32d28a3b0b03a0b2c
- SSDEEP 3072:Ccon+IxCF0mHK4curv/EMJPQglgdTBd04ca8psCqaYs0vsF8GsxWvv9Ed42:Ccon6Ffdrn9J4XT7xb8pdfF/sW+d42
- TLSH T15014493062C08431FAA2C97C14E19F314579BC64BF2199D7BB5C3DAA4BEC4C1D93A6B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
8 signatures
Behavioral task
behavioral1
Sample
2026-08-07_60c7843726f6fc813aab734ae070864c_amadey_cobalt-strike_elex_feodo_qilin.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_60c7843726f6fc813aab734ae070864c_amadey_cobalt-strike_elex_feodo_qilin.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-07_60c7843726f6fc813aab734ae070864c_amadey_cobalt-strike_elex_feodo_qilin
- Size 186KB
- SHA256 158f151b7a33703789990ffd3b69b8e25f99db322c801f3c2a0062f6221e6635
- MD5 60c7843726f6fc813aab734ae070864c
- SHA1 00e9f85cbc5d82d8f07bc9a12c25c2852ff43210
- SHA512 8588c9b89822faadb3b476d1c40a652fe2bfe17f2be0f1f0b897a6863981dece0495036f2b10d5af216be40cc847475456a33b6b09b832f32d28a3b0b03a0b2c
- SSDEEP 3072:Ccon+IxCF0mHK4curv/EMJPQglgdTBd04ca8psCqaYs0vsF8GsxWvv9Ed42:Ccon6Ffdrn9J4XT7xb8pdfF/sW+d42
- TLSH T15014493062C08431FAA2C97C14E19F314579BC64BF2199D7BB5C3DAA4BEC4C1D93A6B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.