2026-08-20_ed49fb6e26c19dc8d0bfef798cf6de74_amadey_cobalt-strike_elex_floxif_play

General

Target
2026-08-20_ed49fb6e26c19dc8d0bfef798cf6de74_amadey_cobalt-strike_elex_floxif_play
Size 170KB
Sample260820-rh483aydld
SHA256 02406719d1cc296bc30b003ffd73b47bb5d212883ffeed56b1ab233bdc182deb
MD5 ed49fb6e26c19dc8d0bfef798cf6de74
SHA1 a39e57dbc39b1ecfecc69c84b30039e5545810cb
SHA512 c52c5d385d9987a6d25a2a5bad8b13dc94ec96f26a4a55a0c315aa8ca2159b2f31883f97ff8ec26d1b62e70a551f8ab742c40de776e0829d5d65ce9a3199d409
SSDEEP 3072:ejcjOaPrx0X3XJ/YssmleResvH8Rii6/2lQBV+UdE+rECWp7hKib:4ejQXhs6zq8RiBBV+UdvrEFp7hKib
TLSH
T11E04BF03B68087FDD7650530346CEA628DFEB83C0FAA45ABB755052A4F3CB839A5951F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-20_ed49fb6e26c19dc8d0bfef798cf6de74_amadey_cobalt-strike_elex_floxif_play

File Explorer

2026-08-20_ed49fb6e26c19dc8d0bfef798cf6de74_amadey_cobalt-strike_elex_floxif_play

.exe 170KB

2026-08-20_ed49fb6e26c19dc8d0bfef798cf6de74_amadey_cobalt-strike_elex_floxif_play

IMPHASH 57d82a4bdac8c9f7729a1f07acfc3aa0
SHA256 02406719d1cc296bc30b003ffd73b47bb5d212883ffeed56b1ab233bdc182deb
MD5 ed49fb6e26c19dc8d0bfef798cf6de74
SHA1 a39e57dbc39b1ecfecc69c84b30039e5545810cb
SHA512 c52c5d385d9987a6d25a2a5bad8b13dc94ec96f26a4a55a0c315aa8ca2159b2f31883f97ff8ec26d1b62e70a551f8ab742c40de776e0829d5d65ce9a3199d409
SSDEEP 3072:ejcjOaPrx0X3XJ/YssmleResvH8Rii6/2lQBV+UdE+rECWp7hKib:4ejQXhs6zq8RiBBV+UdvrEFp7hKib
TLSH
T11E04BF03B68087FDD7650530346CEA628DFEB83C0FAA45ABB755052A4F3CB839A5951F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

fa:20:d1:29:2c:c1:b5:7d:9c:a2:2d:c5:eb:2d:17:80:33:7b:90:b9:e5:dd:9c:41:df:42:0f:6d:a3:53:f3:07

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Firebit OU,OU=IT,O=Firebit OU,POSTALCODE=15551,STREET=Sepapaja tn 6,L=Tallinn,ST=Harjumaa,C=EE

Chains

Dec 25, 2022

CN=Firebit OU,OU=IT,O=Firebit OU,POSTALCODE=15551,STREET=Sepapaja tn 6,L=Tallinn,ST=Harjumaa,C=EE

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=Firebit OU,OU=IT,O=Firebit OU,POSTALCODE=15551,STREET=Sepapaja tn 6,L=Tallinn,ST=Harjumaa,C=EE

Serial Number

d6:aa:3c:89:1f:c2:cb:dd:7e:18:52:57:e9:22:70:1a

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 28, 2021 - Jan 28, 2024

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 2, 2018 - Dec 31, 2030

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 11, 2022 - Aug 10, 2033

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

0

Major OS version

6

Entry point

29024

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Rainmeter4\x32-Release\Obj\RestartRainmeter\RestartRainmeter.pdb

kernel32

SetErrorMode CreateMutexW ReleaseMutex CreateToolhelp32Snapshot GetLastError Process32NextW Process32FirstW CloseHandle WriteConsoleW CreateFileW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize GetProcessHeap LCMapStringW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW GetCurrentProcess TerminateProcess RaiseException RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW DecodePointer

user32

PostQuitMessage KillTimer GetMessageW DefWindowProcW PostMessageW CreateWindowExW UnregisterClassW RegisterClassExW DispatchMessageW SetTimer TranslateMessage FindWindowW

shell32

ShellExecuteExW ShellExecuteW

ole32

CoInitializeEx CoUninitialize

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_ed49fb6e26c19dc8d0bfef798cf6de74_amadey_cobalt-strike_elex_floxif_play

PE Signature issue

kernel32

user32

shell32

ole32

generic