2026-10-13_d948fffd86ca7fd5da4c2b14d405a496_amadey_cobalt-strike_elex_hellokitty

General

Target
2026-10-13_d948fffd86ca7fd5da4c2b14d405a496_amadey_cobalt-strike_elex_hellokitty
Size 95KB
Sample261014-e32bpav15p
SHA256 fb878da8ce953fcebf457b79a28d3bad25fd9ff152b0eb08b7e4ba70465f0a3e
MD5 d948fffd86ca7fd5da4c2b14d405a496
SHA1 d72bf6e9b455391d28d0d78da6495c0fb09d3c86
SHA512 7a40fa083e2cced5d4f0a6c61cb4ea8aae452674b83421350604ef879f354fb9be5aed3dffdf22d2e780b9ed9027814b7e48627e7c8f011af11aef02c7b7a304
SSDEEP 1536:TpHLpMzyXbOJbTQNtCCgkW0Em2MqA8EYOLXutz+QhQizJ4HyVAsWp9cdR7zEWpB:VaO1GkOm2LDOLXuPhQeJ4S9R7zEU
TLSH
T1B2A37C01B5D1C471C575193508A4DAB59E3DFE700F219FEB779826BA0F302C29A36EAB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-13_d948fffd86ca7fd5da4c2b14d405a496_amadey_cobalt-strike_elex_hellokitty

File Explorer

2026-10-13_d948fffd86ca7fd5da4c2b14d405a496_amadey_cobalt-strike_elex_hellokitty

.exe 95KB

2026-10-13_d948fffd86ca7fd5da4c2b14d405a496_amadey_cobalt-strike_elex_hellokitty

IMPHASH 6b003805aeef063cb573de37633b524d
SHA256 fb878da8ce953fcebf457b79a28d3bad25fd9ff152b0eb08b7e4ba70465f0a3e
MD5 d948fffd86ca7fd5da4c2b14d405a496
SHA1 d72bf6e9b455391d28d0d78da6495c0fb09d3c86
SHA512 7a40fa083e2cced5d4f0a6c61cb4ea8aae452674b83421350604ef879f354fb9be5aed3dffdf22d2e780b9ed9027814b7e48627e7c8f011af11aef02c7b7a304
SSDEEP 1536:TpHLpMzyXbOJbTQNtCCgkW0Em2MqA8EYOLXutz+QhQizJ4HyVAsWp9cdR7zEWpB:VaO1GkOm2LDOLXuPhQeJ4S9R7zEU
TLSH
T1B2A37C01B5D1C471C575193508A4DAB59E3DFE700F219FEB779826BA0F302C29A36EAB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

10237

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW GetCurrentProcess TerminateProcess WriteConsoleW RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetFileType HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetProcessHeap GetFileSizeEx SetFilePointerEx GetConsoleOutputCP GetConsoleMode HeapSize HeapReAlloc FlushFileBuffers CloseHandle CreateFileW DecodePointer

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-13_d948fffd86ca7fd5da4c2b14d405a496_amadey_cobalt-strike_elex_hellokitty

kernel32

generic