2026-09-08_d04ef251061785d5b27240971bd6cccd_amadey_cobalt-strike_elex_play

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-08_d04ef251061785d5b27240971bd6cccd_amadey_cobalt-strike_elex_play
Size 268KB
Sample260910-c3jersdk5z
SHA256 360a8ac8990e46c261e34c489fd4e62a7d28eeb9a56c432b97e19cd8e30c66a5
MD5 d04ef251061785d5b27240971bd6cccd
SHA1 ddafb272cfad4cf5d29ed35964a5771777397ab1
SHA512 6010448ab8a2d5a48e8634545841950b0d3b42f69393dc3aeb7e1015195c48182b55549d82a26b5aa51bdb400b0780ebbfe08f2fb4492f75d768a820b7dc9b41
SSDEEP 6144:tQMIM5FUTfMSgilMp+nVL3XE/Il1pcYqS9vR:tQMH5FUGyVjU/Il1pcw9vR
TLSH
T13244D05071D28270D8770C779CBD6B984B7DF8240FB07EF7A38815AB4A706D06B366A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-08_d04ef251061785d5b27240971bd6cccd_amadey_cobalt-strike_elex_play

File Explorer

2026-09-08_d04ef251061785d5b27240971bd6cccd_amadey_cobalt-strike_elex_play

.exe 268KB

2026-09-08_d04ef251061785d5b27240971bd6cccd_amadey_cobalt-strike_elex_play

IMPHASH c2bdfbf405fed90ff96837c520d29aa5
SHA256 360a8ac8990e46c261e34c489fd4e62a7d28eeb9a56c432b97e19cd8e30c66a5
MD5 d04ef251061785d5b27240971bd6cccd
SHA1 ddafb272cfad4cf5d29ed35964a5771777397ab1
SHA512 6010448ab8a2d5a48e8634545841950b0d3b42f69393dc3aeb7e1015195c48182b55549d82a26b5aa51bdb400b0780ebbfe08f2fb4492f75d768a820b7dc9b41
SSDEEP 6144:tQMIM5FUTfMSgilMp+nVL3XE/Il1pcYqS9vR:tQMH5FUGyVjU/Il1pcw9vR
TLSH
T13244D05071D28270D8770C779CBD6B984B7DF8240FB07EF7A38815AB4A706D06B366A9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20207

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

gdiplus

GdipFree GdiplusStartup GdiplusShutdown GdipDrawImageI GdipGraphicsClear GdipDeleteGraphics GdipCreateFromHDC GdipGetPropertyItem GdipGetPropertyItemSize GdipImageSelectActiveFrame GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipCloneImage GdipLoadImageFromFileICM GdipLoadImageFromStreamICM GdipLoadImageFromFile GdipLoadImageFromStream GdipAlloc

ole32

CreateStreamOnHGlobal

user32

GetMessageW LoadIconW LoadCursorA MessageBoxW AdjustWindowRectEx SetWindowTextW RedrawWindow InvalidateRect EndPaint BeginPaint UpdateWindow DrawMenuBar KillTimer SetTimer SetWindowPos ShowWindow CreateWindowExW RegisterClassW PostQuitMessage DefWindowProcW SendMessageW DispatchMessageW TranslateMessage

shell32

CommandLineToArgvW

kernel32

DecodePointer WriteConsoleW CloseHandle CreateFileW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize GetStringTypeW SetStdHandle GetFileType GetProcessHeap LCMapStringW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapFree HeapAlloc GetCommandLineW LoadResource LockResource SizeofResource GlobalAlloc GlobalUnlock GlobalLock GlobalFree LocalFree FindResourceA IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetStdHandle RaiseException RtlUnwind GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW WriteFile

Name

.text

Size

71KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

160KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-08_d04ef251061785d5b27240971bd6cccd_amadey_cobalt-strike_elex_play

gdiplus

ole32

user32

shell32

kernel32

generic