2026-10-28_598b46ffa74ed60bbe0c0195857e450a_amadey_cobalt-strike_elex_smoke-loader

General

Target
2026-10-28_598b46ffa74ed60bbe0c0195857e450a_amadey_cobalt-strike_elex_smoke-loader
Size 670KB
Sample261030-ekdsnsav5m
SHA256 e2e406085e482b3c39899d417a4079842425d0aebfc7ef3abc6dedd82c76dd90
MD5 598b46ffa74ed60bbe0c0195857e450a
SHA1 a1b3f6fdbe7f646a806facd441c3a67f26a17d0b
SHA512 a6694aa766e884a16abcd199069482cdf4de7795d14c43ac307eefb18222162e4c87b0ad1a717dfe5eed9ed6041d9ed3cacc7f2c2edd521eef00d6b9fde99cf5
SSDEEP 6144:ZZzvhs2Z4n1E7g34XtVYAOfTdP5Ker1PJVHjMYsmBSfN/yw+Aw1ECD45rj17U:ZJ+2Z4nShVY555KgHUizA1CGZ7U
TLSH
T1BDE48CE1FDD210FDC0B758364CB59E306A3BAC1149C1DEA366863ABC467319659332AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-28_598b46ffa74ed60bbe0c0195857e450a_amadey_cobalt-strike_elex_smoke-loader

.exe 670KB

2026-10-28_598b46ffa74ed60bbe0c0195857e450a_amadey_cobalt-strike_elex_smoke-loader

IMPHASH a99648a4d417f4130faca9d4625edb8e
SHA256 e2e406085e482b3c39899d417a4079842425d0aebfc7ef3abc6dedd82c76dd90
MD5 598b46ffa74ed60bbe0c0195857e450a
SHA1 a1b3f6fdbe7f646a806facd441c3a67f26a17d0b
SHA512 a6694aa766e884a16abcd199069482cdf4de7795d14c43ac307eefb18222162e4c87b0ad1a717dfe5eed9ed6041d9ed3cacc7f2c2edd521eef00d6b9fde99cf5
SSDEEP 6144:ZZzvhs2Z4n1E7g34XtVYAOfTdP5Ker1PJVHjMYsmBSfN/yw+Aw1ECD45rj17U:ZJ+2Z4nShVY555KgHUizA1CGZ7U
TLSH
T1BDE48CE1FDD210FDC0B758364CB59E306A3BAC1149C1DEA366863ABC467319659332AF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

fc:22:2b:4b:65:a9:2a:e0:9f:14:81:a3:b0:8a:9b:c5:47:fe:19:b7:e6:93:a9:be:ae:d7:1a:7e:c3:95:b1:c0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=WeMod LLC,O=WeMod LLC,L=Boston,ST=Massachusetts,C=US

Chains

Oct 22, 2026

CN=WeMod LLC,O=WeMod LLC,L=Boston,ST=Massachusetts,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=WeMod LLC,O=WeMod LLC,L=Boston,ST=Massachusetts,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=WeMod LLC,O=WeMod LLC,L=Boston,ST=Massachusetts,C=US

Serial Number

0d:93:c5:3b:ff:1e:6a:cf:b1:6f:d1:d4:dc:1e:cc:75

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 17, 2026 - Apr 7, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Aug 5, 2026 - Nov 4, 2037

Minor OS version

0

Major OS version

6

Entry point

34859

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\ani\code\squirrel\squirrel.windows\build\Release\Win32\StubExecutable.pdb

kernel32

GetModuleFileNameW GetModuleHandleW FindFirstFileW FindNextFileW FindClose CreateProcessW CreateFileW CloseHandle WideCharToMultiByte GetLastError MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetProcAddress EnterCriticalSection LeaveCriticalSection DeleteCriticalSection LCMapStringW GetLocaleInfoW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwind RaiseException FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile HeapFree HeapAlloc IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle SetFilePointerEx HeapSize FlushFileBuffers GetConsoleCP GetConsoleMode WriteConsoleW

user32

AllowSetForegroundWindow WaitForInputIdle

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_598b46ffa74ed60bbe0c0195857e450a_amadey_cobalt-strike_elex_smoke-loader

kernel32

user32

generic