2026-09-29_540351bfc9447eac740db5ae237dc1e3_amadey_cobalt-strike_elex_play

General

Target
2026-09-29_540351bfc9447eac740db5ae237dc1e3_amadey_cobalt-strike_elex_play
Size 83KB
Sample260930-bbbeeabc74
SHA256 a4cbec0fdc27dea6f3f389af4ab72c8bd749a13128a2ef7828d9331cc28741b8
MD5 540351bfc9447eac740db5ae237dc1e3
SHA1 99f2a76f4188138fe2a6c766b1a79c843e01314d
SHA512 21aded2d4628c2e5d594849fe4e66a57232e0ba893670f0e9f9da406051835b6234103b3e1f5a31efa94342744263744e8fefe78d7a4d4beabbd9779078e99c3
SSDEEP 1536:iBZUj3nCsjvHhXmiT9Y2yWkjar0P1EMYSXzHvsWUJDocdFgJbxDPH:Lrn5jvHhX3yWkjar0P1XDKHFgJblPH
TLSH
T118835A43B5D194B1E4720A324868EAA59A3FFC205F60DE6B3785263E0F301D18D36DBB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_540351bfc9447eac740db5ae237dc1e3_amadey_cobalt-strike_elex_play

File Explorer

2026-09-29_540351bfc9447eac740db5ae237dc1e3_amadey_cobalt-strike_elex_play

.exe 83KB

2026-09-29_540351bfc9447eac740db5ae237dc1e3_amadey_cobalt-strike_elex_play

IMPHASH ed242d07b4f9696f1117364520433fc1
SHA256 a4cbec0fdc27dea6f3f389af4ab72c8bd749a13128a2ef7828d9331cc28741b8
MD5 540351bfc9447eac740db5ae237dc1e3
SHA1 99f2a76f4188138fe2a6c766b1a79c843e01314d
SHA512 21aded2d4628c2e5d594849fe4e66a57232e0ba893670f0e9f9da406051835b6234103b3e1f5a31efa94342744263744e8fefe78d7a4d4beabbd9779078e99c3
SSDEEP 1536:iBZUj3nCsjvHhXmiT9Y2yWkjar0P1EMYSXzHvsWUJDocdFgJbxDPH:Lrn5jvHhX3yWkjar0P1XDKHFgJblPH
TLSH
T118835A43B5D194B1E4720A324868EAA59A3FFC205F60DE6B3785263E0F301D18D36DBB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

7950

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SizeofResource LockResource LoadResource FindResourceW SetThreadErrorMode WriteConsoleW CloseHandle CreateFileW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind RaiseException GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetDriveTypeW GetFullPathNameW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW HeapFree HeapAlloc MultiByteToWideChar WideCharToMultiByte LCMapStringW GetCurrentDirectoryW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx DecodePointer

shell32

ShellExecuteW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_540351bfc9447eac740db5ae237dc1e3_amadey_cobalt-strike_elex_play

kernel32

shell32

generic