2026-11-11_0cd3fc8cfd5143c410cb7dfafb968269_amadey_cobalt-strike_elex_hellokitty

General

Target
2026-11-11_0cd3fc8cfd5143c410cb7dfafb968269_amadey_cobalt-strike_elex_hellokitty
Size 659KB
Sample261113-v7465sd16n
SHA256 3922e262fb0563e2b1747dc9c077ab02d73afd52dc210b22401545ab592899f8
MD5 0cd3fc8cfd5143c410cb7dfafb968269
SHA1 c17ec3e40c2d84ae265b95af63b12ea1744fe0cf
SHA512 f8127fef77074ff3f7b1ec25c8c9a3dc57073e51c6477bab12ab74863ebb3c06810c1f1e71ce3e4570032343abb39654e5f05a1f3a43e339b69a63ce81e3c551
SSDEEP 12288:fRtwmHK86RgpMDrvBNGopBRwAIXVRyD3PZaoSTgXa4bpigIeBeb+5atOXl:fXa86kMP5N3ARyrZzSsXNbsdeBebhw
TLSH
T147E41212B2C1D932DE76143208A4D9A1492DEDB11F254FEB338D763A0A381D59E3BE77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-11_0cd3fc8cfd5143c410cb7dfafb968269_amadey_cobalt-strike_elex_hellokitty

File Explorer

2026-11-11_0cd3fc8cfd5143c410cb7dfafb968269_amadey_cobalt-strike_elex_hellokitty

.exe 659KB

2026-11-11_0cd3fc8cfd5143c410cb7dfafb968269_amadey_cobalt-strike_elex_hellokitty

IMPHASH e2bb1f683b494254dbd6bdeffa82c8f6
SHA256 3922e262fb0563e2b1747dc9c077ab02d73afd52dc210b22401545ab592899f8
MD5 0cd3fc8cfd5143c410cb7dfafb968269
SHA1 c17ec3e40c2d84ae265b95af63b12ea1744fe0cf
SHA512 f8127fef77074ff3f7b1ec25c8c9a3dc57073e51c6477bab12ab74863ebb3c06810c1f1e71ce3e4570032343abb39654e5f05a1f3a43e339b69a63ce81e3c551
SSDEEP 12288:fRtwmHK86RgpMDrvBNGopBRwAIXVRyD3PZaoSTgXa4bpigIeBeb+5atOXl:fXa86kMP5N3ARyrZzSsXNbsdeBebhw
TLSH
T147E41212B2C1D932DE76143208A4D9A1492DEDB11F254FEB338D763A0A381D59E3BE77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

11486

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\rc_v12_i18n_202508_branch\Build\Release\WPSOffice\office6\addons\chromehost\chromelauncher.pdb

kernel32

GetEnvironmentVariableW SetEnvironmentVariableW FreeLibrary GetProcAddress LoadLibraryW GetFileAttributesW GetModuleFileNameW WriteConsoleW RaiseException GetLastError GetSystemInfo VirtualProtect VirtualQuery GetModuleHandleW LoadLibraryExA QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess RtlUnwind SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW CompareStringW LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx CreateFileW CloseHandle DecodePointer

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-11_0cd3fc8cfd5143c410cb7dfafb968269_amadey_cobalt-strike_elex_hellokitty

kernel32

generic