2026-08-19_d5ac7c0333945dc88ca88c808543e349_amadey_cobalt-strike_elex_play

General

Target
2026-08-19_d5ac7c0333945dc88ca88c808543e349_amadey_cobalt-strike_elex_play
Size 88KB
Sample260820-bsehdsag85
SHA256 17c5708279ee27c98e4d852e454f0373536bd08efd74697f5cd9e04ef295a7a2
MD5 d5ac7c0333945dc88ca88c808543e349
SHA1 2a95b171cad256790de6115a75166fd50f3d1f36
SHA512 8bb115ed785c547e70a3a33588f8c40fa56e3aab64c8fccad8fcfe3c72a3d3f794137f5fbb91733594fb911d51e3e0bfb983369ab337c0af6970ed371bf4401e
SSDEEP 1536:6Uqk3uhJWSeiBv9ce9CSeSmcOYYznpd9NJAa3TZOqmPgRa70KL5nk5sWWkcdxgkD:R0UPC9VjeYYznjJAa39OqmPguJL5kWxZ
TLSH
T138936D42B5D1C471E67619351C64DAA09B3EF8501F719EEF378806BE8F342C09A36EB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-19_d5ac7c0333945dc88ca88c808543e349_amadey_cobalt-strike_elex_play

File Explorer

2026-08-19_d5ac7c0333945dc88ca88c808543e349_amadey_cobalt-strike_elex_play

.exe 88KB

2026-08-19_d5ac7c0333945dc88ca88c808543e349_amadey_cobalt-strike_elex_play

IMPHASH a8ad65b97a2cf19c19eb7a490684226f
SHA256 17c5708279ee27c98e4d852e454f0373536bd08efd74697f5cd9e04ef295a7a2
MD5 d5ac7c0333945dc88ca88c808543e349
SHA1 2a95b171cad256790de6115a75166fd50f3d1f36
SHA512 8bb115ed785c547e70a3a33588f8c40fa56e3aab64c8fccad8fcfe3c72a3d3f794137f5fbb91733594fb911d51e3e0bfb983369ab337c0af6970ed371bf4401e
SSDEEP 1536:6Uqk3uhJWSeiBv9ce9CSeSmcOYYznpd9NJAa3TZOqmPgRa70KL5nk5sWWkcdxgkD:R0UPC9VjeYYznjJAa39OqmPguJL5kWxZ
TLSH
T138936D42B5D1C471E67619351C64DAA09B3EF8501F719EEF378806BE8F342C09A36EB6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

5096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle WaitForSingleObject CreateRemoteThread GetExitCodeThread OpenProcess VirtualAllocEx WriteProcessMemory VirtualFreeEx GetModuleHandleA GetProcAddress WriteConsoleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW GetCurrentProcess TerminateProcess RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW DecodePointer

Name

.text

Size

55KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

25KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-19_d5ac7c0333945dc88ca88c808543e349_amadey_cobalt-strike_elex_play

kernel32

generic