2026-08-08_9474f16b30c6414969041050233140d2_akira_amadey_cobalt-strike_elex_glassworm

General

Target
2026-08-08_9474f16b30c6414969041050233140d2_akira_amadey_cobalt-strike_elex_glassworm
Size 383KB
Sample260808-dl85ja11f1
SHA256 d6f430759e99c098f89a2e8e0b595d5a9d37547996183db262e672718c7a366e
MD5 9474f16b30c6414969041050233140d2
SHA1 38bb4a54766889539f9da6b9e70aff87962160c2
SHA512 6b568a3534ce88296638d0c55771946e66ed1ba1eba53d65f9ab397dabbdec393a3d1701ba43a0ebe61368fe82006606608b5cf6c66ceb86e388aa621275aa52
SSDEEP 6144:enGCgJJkYL+FwHS6thnL5qEW18NoQ2UWASSgNlXgCtBZ19gLz1ulvlDe+dzYufZn:KSJJkYLauS67aQ2UWIgXgCtgLz1uXe+h
TLSH
T11D849D52BF40C0B7D44740729D3DE73DCB3BA1161B108EE7B3E54A989E357A04E366AA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_9474f16b30c6414969041050233140d2_akira_amadey_cobalt-strike_elex_glassworm

File Explorer

2026-08-08_9474f16b30c6414969041050233140d2_akira_amadey_cobalt-strike_elex_glassworm

.exe 383KB

2026-08-08_9474f16b30c6414969041050233140d2_akira_amadey_cobalt-strike_elex_glassworm

IMPHASH 78c016150ecdff5dc7a78e74bd2b3d20
SHA256 d6f430759e99c098f89a2e8e0b595d5a9d37547996183db262e672718c7a366e
MD5 9474f16b30c6414969041050233140d2
SHA1 38bb4a54766889539f9da6b9e70aff87962160c2
SHA512 6b568a3534ce88296638d0c55771946e66ed1ba1eba53d65f9ab397dabbdec393a3d1701ba43a0ebe61368fe82006606608b5cf6c66ceb86e388aa621275aa52
SSDEEP 6144:enGCgJJkYL+FwHS6thnL5qEW18NoQ2UWASSgNlXgCtBZ19gLz1ulvlDe+dzYufZn:KSJJkYLauS67aQ2UWIgXgCtgLz1uXe+h
TLSH
T11D849D52BF40C0B7D44740729D3DE73DCB3BA1161B108EE7B3E54A989E357A04E366AA
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

229617

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InitOnceBeginInitialize TlsAlloc InitOnceComplete TlsFree ReleaseSRWLockExclusive GetConsoleMode GetStdHandle WriteConsoleW WaitForSingleObject TlsSetValue GetCurrentProcess GetCurrentThread ReleaseMutex WaitForSingleObjectEx LoadLibraryA CreateMutexA GetProcAddress GetCurrentThreadId GetModuleHandleA SetThreadStackGuarantee SleepEx GetModuleHandleW FormatMessageW CreateFileW SetFileTime SetFileInformationByHandle GetFullPathNameW FindFirstFileExW FindClose GetFileInformationByHandle TlsGetValue TryAcquireSRWLockExclusive GetSystemTimeAsFileTime DuplicateHandle CreateDirectoryW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW CreateThread GetTempPathW CopyFileExW MoveFileExW CreateWaitableTimerExW SetWaitableTimer Sleep LoadLibraryExA AcquireSRWLockExclusive SystemTimeToFileTime GetCommandLineW MultiByteToWideChar GetCurrentDirectoryW lstrlenW WideCharToMultiByte GetEnvironmentVariableW ReadFileEx WriteFileEx CompareStringOrdinal GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap HeapFree HeapAlloc GetProcessId SystemTimeToTzSpecificLocalTime GetCurrentProcessId GetLastError SetLastError GetFileInformationByHandleEx LCMapStringW CompareStringW RaiseException GetSystemInfo FreeLibrary IsDebuggerPresent GetStartupInfoW IsProcessorFeaturePresent TerminateProcess RtlUnwind EncodePointer LoadLibraryExW ExitProcess GetModuleHandleExW FindNextFileW SetStdHandle GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree FlushFileBuffers GetConsoleOutputCP SetFilePointerEx DecodePointer InitializeSListHead EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount WriteFile GetCommandLineA IsValidCodePage GetACP GetOEMCP GetCPInfo SetEnvironmentVariableW GetStringTypeW InitializeCriticalSectionEx CloseHandle HeapSize QueryPerformanceCounter QueryPerformanceFrequency RtlCaptureContext HeapReAlloc AddVectoredExceptionHandler SetUnhandledExceptionFilter VirtualProtect VirtualQuery UnhandledExceptionFilter

user32

AllowSetForegroundWindow

ntdll

NtWriteFile RtlNtStatusToDosError NtOpenFile NtReadFile NtCreateNamedPipeFile

Name

.text

Size

287KB

Virtual Size

287KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

75KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_9474f16b30c6414969041050233140d2_akira_amadey_cobalt-strike_elex_glassworm

kernel32

user32

ntdll

generic