2026-10-26_fe6b6d648276062960d64db8de10af36_amadey_cobalt-strike_elex_hellokitty_smoke-loader_wapomi

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_fe6b6d648276062960d64db8de10af36_amadey_cobalt-strike_elex_hellokitty_smoke-loader_wapomi
Size 239KB
Sample261027-bbl6xaav8l
SHA256 31d69ae1070f1679ec6a4b89f3266c8de6dba8f4c0ec6b13b54252416e81519f
MD5 fe6b6d648276062960d64db8de10af36
SHA1 d0833c896eb735bf9479fcdf334338b563978ec6
SHA512 32c2519498db71ed9a01ba7ce66e52cd304200f9ddfc0888d00baebbea98779fca5039939b596fcdddc11a3c074dfe53820496f6e62cb30fa0ee5b43ddc8f349
SSDEEP 6144:CyW2Nqe9bpoVkiblC8Mppppppp0vLohdmKsAw36nMFW:CydNj9bqpC8wPZA6nMF
TLSH
T18B348C1274C184B2F476093344A1DDA44A7EFD745E20AAAB3B8C7B7F4F355818A22B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_fe6b6d648276062960d64db8de10af36_amadey_cobalt-strike_elex_hellokitty_smoke-loader_wapomi

File Explorer

2026-10-26_fe6b6d648276062960d64db8de10af36_amadey_cobalt-strike_elex_hellokitty_smoke-loader_wapomi

.exe 239KB

2026-10-26_fe6b6d648276062960d64db8de10af36_amadey_cobalt-strike_elex_hellokitty_smoke-loader_wapomi

IMPHASH 153f025dcca40e1f7e0b8d74926adf21
SHA256 31d69ae1070f1679ec6a4b89f3266c8de6dba8f4c0ec6b13b54252416e81519f
MD5 fe6b6d648276062960d64db8de10af36
SHA1 d0833c896eb735bf9479fcdf334338b563978ec6
SHA512 32c2519498db71ed9a01ba7ce66e52cd304200f9ddfc0888d00baebbea98779fca5039939b596fcdddc11a3c074dfe53820496f6e62cb30fa0ee5b43ddc8f349
SSDEEP 6144:CyW2Nqe9bpoVkiblC8Mppppppp0vLohdmKsAw36nMFW:CydNj9bqpC8wPZA6nMF
TLSH
T18B348C1274C184B2F476093344A1DDA44A7EFD745E20AAAB3B8C7B7F4F355818A22B77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

245760

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

shlwapi

PathRemoveBackslashW PathFileExistsW PathUnquoteSpacesW

kernel32

K32GetProcessImageFileNameW OpenProcess CreateToolhelp32Snapshot Sleep Process32NextW GetUserDefaultLCID DeleteFileW GetModuleFileNameW CloseHandle GetNativeSystemInfo LocalFree CopyFileW GetConsoleMode GetConsoleOutputCP TerminateProcess GetCommandLineW WriteConsoleW Process32FirstW UnhandledExceptionFilter FlushFileBuffers HeapReAlloc HeapSize GetProcessHeap LCMapStringW FormatMessageA CreateFileW FindClose FindFirstFileExW FindNextFileW GetFileAttributesW GetFileAttributesExW SetFileInformationByHandle SetFilePointerEx GetTempPathW AreFileApisANSI GetLastError GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte DecodePointer SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind RaiseException SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetCPInfo GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapAlloc HeapFree GetStringTypeW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType

user32

MessageBoxW

advapi32

RegDeleteKeyW RegDeleteTreeW RegOpenKeyExW RegDeleteValueW RegQueryValueExW RegCloseKey

shell32

ShellExecuteW CommandLineToArgvW ShellExecuteExW SHGetKnownFolderPath SHChangeNotify

ole32

CoTaskMemFree

Name

.text

Size

61KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

119KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

~/D8�u�

Size

16KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_fe6b6d648276062960d64db8de10af36_amadey_cobalt-strike_elex_hellokitty_smoke-loader_wapomi

shlwapi

kernel32

user32

advapi32

shell32

ole32

generic