2026-08-09_015e198b62d02ce14d07aa5c130d0eef_amadey_cobalt-strike_conti_elex_floxif_hellokitty_njrat_play

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_015e198b62d02ce14d07aa5c130d0eef_amadey_cobalt-strike_conti_elex_floxif_hellokitty_njrat_play
Size 263KB
Sample260809-gmd8bsvydv
SHA256 c417cf29b51e94bd8e4d1a1ed04a0ffadd6d1ef3f86c5b405892a149dc7714af
MD5 015e198b62d02ce14d07aa5c130d0eef
SHA1 a5ac1bffed47edd3973d303e2e6763374d42444e
SHA512 5e08984fb692ca0c28d0cdbc19b443860073855652a008f6541bf5d8dfe547b07c588180c62f8d380c9b986957405b19c7067c36e68148611494b6cfc4a0f304
SSDEEP 6144:KKD6jt9qxDQ/gYVjpPg9vTBV+UdvrEFp7hKRRn:KKD6J/pVGvTBjvrEH769
TLSH
T1AE448DC076C0C3E7DC60F83CB474EA6409E9F87C58694A8BAFD4157D9E6C6CA4506E2E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-09_015e198b62d02ce14d07aa5c130d0eef_amadey_cobalt-strike_conti_elex_floxif_hellokitty_njrat_play

File Explorer

2026-08-09_015e198b62d02ce14d07aa5c130d0eef_amadey_cobalt-strike_conti_elex_floxif_hellokitty_njrat_play

.exe 263KB

2026-08-09_015e198b62d02ce14d07aa5c130d0eef_amadey_cobalt-strike_conti_elex_floxif_hellokitty_njrat_play

IMPHASH e96ce816824b3e9c2864d26b3c392e7f
SHA256 c417cf29b51e94bd8e4d1a1ed04a0ffadd6d1ef3f86c5b405892a149dc7714af
MD5 015e198b62d02ce14d07aa5c130d0eef
SHA1 a5ac1bffed47edd3973d303e2e6763374d42444e
SHA512 5e08984fb692ca0c28d0cdbc19b443860073855652a008f6541bf5d8dfe547b07c588180c62f8d380c9b986957405b19c7067c36e68148611494b6cfc4a0f304
SSDEEP 6144:KKD6jt9qxDQ/gYVjpPg9vTBV+UdvrEFp7hKRRn:KKD6J/pVGvTBjvrEH769
TLSH
T1AE448DC076C0C3E7DC60F83CB474EA6409E9F87C58694A8BAFD4157D9E6C6CA4506E2E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

c4:db:98:c2:e5:70:cd:eb:ed:1e:57:38:1d:19:0f:e1:b2:df:75:4d:12:a9:4b:d0:df:da:0a:ab:95:0d:2b:fd

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=DYUNER\, OOO,O=DYUNER\, OOO,POSTALCODE=224030,STREET=Ostrovskogo 5/1,L=Brest,C=BY

Chains

Jun 28, 2022

CN=DYUNER\, OOO,O=DYUNER\, OOO,POSTALCODE=224030,STREET=Ostrovskogo 5/1,L=Brest,C=BY

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=DYUNER\, OOO,O=DYUNER\, OOO,POSTALCODE=224030,STREET=Ostrovskogo 5/1,L=Brest,C=BY

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=DYUNER\, OOO,O=DYUNER\, OOO,POSTALCODE=224030,STREET=Ostrovskogo 5/1,L=Brest,C=BY

Serial Number

c5:f2:d3:53:fa:cd:57:a9:70:4e:ed:b9:4e:a8:70

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 3, 2020 - Sep 3, 2022

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 12, 2019 - Dec 31, 2028

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 2, 2018 - Dec 31, 2030

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 11, 2022 - Aug 10, 2033

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

8322

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\My Projects\ExtraDisksMount\Release\ExtraDisksMount.pdb

kernel32

GetLogicalDriveStringsW GetPrivateProfileStringW DeleteFileW CloseHandle DecodePointer ReadConsoleW ReadFile SetEndOfFile HeapReAlloc HeapSize WaitForSingleObject GetConsoleOutputCP FlushFileBuffers CreateFileW SetFilePointerEx GetFileSizeEx GetProcessHeap LCMapStringW GetModuleFileNameW GetPrivateProfileIntW WritePrivateProfileStringW GetVolumeInformationW GetConsoleMode CreateDirectoryW GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW RaiseException GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WriteConsoleW

user32

DefWindowProcW GetMessageW CreateWindowExW RegisterClassExW LoadAcceleratorsW LoadStringW DispatchMessageW TranslateAcceleratorW TranslateMessage LoadIconW LoadCursorW PostQuitMessage BeginPaint EndPaint DestroyWindow

advapi32

RegSetValueExW RegOpenKeyExW RegDeleteValueW RegQueryValueExW RegCloseKey

shell32

ShellExecuteExW SHGetPathFromIDListW SHGetSpecialFolderLocation

shlwapi

StrCpyW StrRChrW StrCatW StrStrW PathFileExistsW StrCmpW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_015e198b62d02ce14d07aa5c130d0eef_amadey_cobalt-strike_conti_elex_floxif_hellokitty_njrat_play

PE Signature issue

kernel32

user32

advapi32

shell32

shlwapi

generic