2026-09-30_494e1fdac27c273847bba32bd272b4d1_amadey_cobalt-strike_conti_elex_hellokitty

General

Target
2026-09-30_494e1fdac27c273847bba32bd272b4d1_amadey_cobalt-strike_conti_elex_hellokitty
Size 158KB
Sample261001-sdwlsstajg
SHA256 450ac294310a75e2b74cc2c7873536e394268ac187ae2d0f815cefd99c1a5681
MD5 494e1fdac27c273847bba32bd272b4d1
SHA1 bb00b488b5f452703a8f96a754e5db02618eebf0
SHA512 97a4cdcec9f6e733a571a97b83ad7760fc79fcb9f1ae6a9e72a7efac4dbf62d4ae1d7a59375091333221a852d48b9ee4786510a776b7925b5cb3645cc2b00f0f
SSDEEP 3072:WS83Bqm1bnQHirEepC+nuFJBqIuY64eeA9nTd1rrCYp:k3BqObnQCrxBoBnuY6R1fCYp
TLSH
T19FF35C5522490BB6F76A643065F43E3198ADE938275F89EBF7F18B250A309C32134F67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_494e1fdac27c273847bba32bd272b4d1_amadey_cobalt-strike_conti_elex_hellokitty

File Explorer

2026-09-30_494e1fdac27c273847bba32bd272b4d1_amadey_cobalt-strike_conti_elex_hellokitty

.exe 158KB

2026-09-30_494e1fdac27c273847bba32bd272b4d1_amadey_cobalt-strike_conti_elex_hellokitty

IMPHASH da35e72aad759882d47127f26a6605d5
SHA256 450ac294310a75e2b74cc2c7873536e394268ac187ae2d0f815cefd99c1a5681
MD5 494e1fdac27c273847bba32bd272b4d1
SHA1 bb00b488b5f452703a8f96a754e5db02618eebf0
SHA512 97a4cdcec9f6e733a571a97b83ad7760fc79fcb9f1ae6a9e72a7efac4dbf62d4ae1d7a59375091333221a852d48b9ee4786510a776b7925b5cb3645cc2b00f0f
SSDEEP 3072:WS83Bqm1bnQHirEepC+nuFJBqIuY64eeA9nTd1rrCYp:k3BqObnQCrxBoBnuY6R1fCYp
TLSH
T19FF35C5522490BB6F76A643065F43E3198ADE938275F89EBF7F18B250A309C32134F67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

80591

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ole32

CoUninitialize CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoCreateInstance

oleaut32

VariantClear SysAllocString VariantInit

ws2_32

htons inet_ntoa WSAGetLastError

kernel32

GetStdHandle WriteConsoleW CreateFileW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers HeapReAlloc HeapSize GetProcessHeap LoadLibraryA GetProcAddress CloseHandle UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW LCMapStringW RaiseException RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW DecodePointer WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_494e1fdac27c273847bba32bd272b4d1_amadey_cobalt-strike_conti_elex_hellokitty

ole32

oleaut32

ws2_32

kernel32

generic