2026-09-10_7f72a8636c915ef6686be31a79047150_amadey_cobalt-strike_elex_play

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-10_7f72a8636c915ef6686be31a79047150_amadey_cobalt-strike_elex_play
Size 721KB
Sample260910-r5ddvshd43
SHA256 e76c4aa6a486d0acbaf04708767a007d826b67750ceaaf2345e4f4a2b50368bc
MD5 7f72a8636c915ef6686be31a79047150
SHA1 3c997dd541063d77df9aaa4ca77f66f4a1122d54
SHA512 17ad938f9a62792dc1c2d61e66f6dec8b26dd011b97c70ed35fe57cd49afa32c20ebea3fc92a09540738c111861a4cc6de20c2e47ef624e99b10189aacb45b9a
SSDEEP 12288:LaGGhkbXB+3p4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:WG/bXBI4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T177F4F10373E8015CF8F36A3159B5A725A83BBDB2D971CA6E178105AD2F32550CE61B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-10_7f72a8636c915ef6686be31a79047150_amadey_cobalt-strike_elex_play

File Explorer

2026-09-10_7f72a8636c915ef6686be31a79047150_amadey_cobalt-strike_elex_play

.exe 721KB

2026-09-10_7f72a8636c915ef6686be31a79047150_amadey_cobalt-strike_elex_play

IMPHASH 703ff56bdeea42466c9707ed3f98c291
SHA256 e76c4aa6a486d0acbaf04708767a007d826b67750ceaaf2345e4f4a2b50368bc
MD5 7f72a8636c915ef6686be31a79047150
SHA1 3c997dd541063d77df9aaa4ca77f66f4a1122d54
SHA512 17ad938f9a62792dc1c2d61e66f6dec8b26dd011b97c70ed35fe57cd49afa32c20ebea3fc92a09540738c111861a4cc6de20c2e47ef624e99b10189aacb45b9a
SSDEEP 12288:LaGGhkbXB+3p4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:WG/bXBI4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T177F4F10373E8015CF8F36A3159B5A725A83BBDB2D971CA6E178105AD2F32550CE61B3B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

31241

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

BraveUpdate_unsigned.pdb

advapi32

RegOpenKeyExW

kernel32

SizeofResource HeapFree GetCommandLineW GetModuleFileNameW InitializeCriticalSectionAndSpinCount HeapSize GetLastError GetFileAttributesExW LockResource HeapReAlloc RaiseException FindResourceExW LoadResource FindResourceW HeapAlloc DecodePointer HeapDestroy GetProcAddress DeleteCriticalSection GetProcessHeap GetModuleHandleW FreeLibrary LoadLibraryExW CloseHandle CreateFileW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetStringTypeW SetStdHandle IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetLastError RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer ExitProcess GetModuleHandleExW GetStdHandle WriteFile FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW GetFileType WriteConsoleW

shell32

SHGetFolderPathW

user32

CharLowerBuffW

shlwapi

SHQueryValueExW PathAppendW PathRemoveFileSpecW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-10_7f72a8636c915ef6686be31a79047150_amadey_cobalt-strike_elex_play

advapi32

kernel32

shell32

user32

shlwapi

generic