2026-08-22_c239d3b08d118b4d50df96daf03563b2_amadey_cobalt-strike_elex_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-22_c239d3b08d118b4d50df96daf03563b2_amadey_cobalt-strike_elex_smoke-loader
Size 291KB
Sample260823-bb275agh87
SHA256 239fe8ea7cd64a8049439e3ebbae97d542dbf385099def06c13618b929d7180a
MD5 c239d3b08d118b4d50df96daf03563b2
SHA1 2ef86f844e223cf97d24687c252f390b1cfdef1d
SHA512 c098a217021c6663e197387a9a494026f7ccca5eb296271128cf4fa92ebc84df445fe6cb6cf8798504dbf6fcf79663ed7a8182e2977e2435a3e43cd4c1f8d33c
SSDEEP 6144:OZzvhs2Z4n1E7g34XtVYAOfTd7Nxd7rb6rUp:OJ+2Z4nShVY5hNxd76rUp
TLSH
T1C0547C21B5D2C4B2D5B3063409F8EBB15A2DFD600F618A7B73D4772E1F741C29632AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-22_c239d3b08d118b4d50df96daf03563b2_amadey_cobalt-strike_elex_smoke-loader

.exe 291KB

2026-08-22_c239d3b08d118b4d50df96daf03563b2_amadey_cobalt-strike_elex_smoke-loader

IMPHASH a99648a4d417f4130faca9d4625edb8e
SHA256 239fe8ea7cd64a8049439e3ebbae97d542dbf385099def06c13618b929d7180a
MD5 c239d3b08d118b4d50df96daf03563b2
SHA1 2ef86f844e223cf97d24687c252f390b1cfdef1d
SHA512 c098a217021c6663e197387a9a494026f7ccca5eb296271128cf4fa92ebc84df445fe6cb6cf8798504dbf6fcf79663ed7a8182e2977e2435a3e43cd4c1f8d33c
SSDEEP 6144:OZzvhs2Z4n1E7g34XtVYAOfTd7Nxd7rb6rUp:OJ+2Z4nShVY5hNxd76rUp
TLSH
T1C0547C21B5D2C4B2D5B3063409F8EBB15A2DFD600F618A7B73D4772E1F741C29632AA6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

61:85:64:f3:1f:c3:a0:1c:00:76:26:b4:1e:31:68:b0:5b:25:ea:b3:6b:9b:bc:6f:cd:3c:b3:c1:56:f9:bb:fa

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Dialpad\, Inc.,O=Dialpad\, Inc.,L=San Ramon,ST=California,C=US

Chains

Aug 13, 2026

CN=Dialpad\, Inc.,O=Dialpad\, Inc.,L=San Ramon,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Dialpad\, Inc.,O=Dialpad\, Inc.,L=San Ramon,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Dialpad\, Inc.,O=Dialpad\, Inc.,L=San Ramon,ST=California,C=US

Serial Number

05:6f:cd:01:f0:58:09:cf:20:72:26:45:4f:50:8f:69

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 13, 2026 - Jul 15, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

34859

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\ani\code\squirrel\squirrel.windows\build\Release\Win32\StubExecutable.pdb

kernel32

GetModuleFileNameW GetModuleHandleW FindFirstFileW FindNextFileW FindClose CreateProcessW CreateFileW CloseHandle WideCharToMultiByte GetLastError MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetProcAddress EnterCriticalSection LeaveCriticalSection DeleteCriticalSection LCMapStringW GetLocaleInfoW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwind RaiseException FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile HeapFree HeapAlloc IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle SetFilePointerEx HeapSize FlushFileBuffers GetConsoleCP GetConsoleMode WriteConsoleW

user32

AllowSetForegroundWindow WaitForInputIdle

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-22_c239d3b08d118b4d50df96daf03563b2_amadey_cobalt-strike_elex_smoke-loader

kernel32

user32

generic