2026-10-14_3c873e835ab03a9738daa7dd7b6f539f_amadey_cobalt-strike_elex_hellokitty

General

Target
2026-10-14_3c873e835ab03a9738daa7dd7b6f539f_amadey_cobalt-strike_elex_hellokitty
Size 95KB
Sample261014-28tkcs1t7l
SHA256 2b2cb093fe848e80c5d6a89f30f8f15c07614ad9606d37b4d58f3c387d68ec82
MD5 3c873e835ab03a9738daa7dd7b6f539f
SHA1 aacb147bc8707134aaa0a85338726d7dcb311de2
SHA512 096af6023a9331e4b183a44bc4086d564642cfe13b93ece3e1f2fe77bd99b4b99091a1cb9744d550fac2948158be04f5b8df6e83043a3fae1e064466b02dde11
SSDEEP 1536:tpHLpMzyXbOJbTQNtCCgkW0Em2MqA8EYOLXutz+QhQizJ4HyVAsWp9cdRxzEWpB:zaO1GkOm2LDOLXuPhQeJ4S9RxzEU
TLSH
T1AFA37C01B5D1C471C575193508A4DAB59E3DFE700F219FEB779826BA0F302C29A36EAB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-14_3c873e835ab03a9738daa7dd7b6f539f_amadey_cobalt-strike_elex_hellokitty

File Explorer

2026-10-14_3c873e835ab03a9738daa7dd7b6f539f_amadey_cobalt-strike_elex_hellokitty

.exe 95KB

2026-10-14_3c873e835ab03a9738daa7dd7b6f539f_amadey_cobalt-strike_elex_hellokitty

IMPHASH 6b003805aeef063cb573de37633b524d
SHA256 2b2cb093fe848e80c5d6a89f30f8f15c07614ad9606d37b4d58f3c387d68ec82
MD5 3c873e835ab03a9738daa7dd7b6f539f
SHA1 aacb147bc8707134aaa0a85338726d7dcb311de2
SHA512 096af6023a9331e4b183a44bc4086d564642cfe13b93ece3e1f2fe77bd99b4b99091a1cb9744d550fac2948158be04f5b8df6e83043a3fae1e064466b02dde11
SSDEEP 1536:tpHLpMzyXbOJbTQNtCCgkW0Em2MqA8EYOLXutz+QhQizJ4HyVAsWp9cdRxzEWpB:zaO1GkOm2LDOLXuPhQeJ4S9RxzEU
TLSH
T1AFA37C01B5D1C471C575193508A4DAB59E3DFE700F219FEB779826BA0F302C29A36EAB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

10237

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW GetCurrentProcess TerminateProcess WriteConsoleW RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetFileType HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetProcessHeap GetFileSizeEx SetFilePointerEx GetConsoleOutputCP GetConsoleMode HeapSize HeapReAlloc FlushFileBuffers CloseHandle CreateFileW DecodePointer

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-14_3c873e835ab03a9738daa7dd7b6f539f_amadey_cobalt-strike_elex_hellokitty

kernel32

generic