2026-03-11_c6fd44e210047a19d582d60aecdc9e69_amadey_cobalt-strike_elex_play
Classification: Malicious
2026-03-11_c6fd44e210047a19d582d60aecdc9e69_amadey_cobalt-strike_elex_play is a malicious file sample. Linked to Play activity.
Detection summary
- 63 antivirus detections
- 0 IDS alerts
- 0 processes observed
- 0 contacted hosts
- 0 DNS requests
MITRE ATT&CK associations
Intrusion sets: PLAY (G1040)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Play | Triage | 2026-03-11 12:00:33 | 2026-03-11 12:00:33 | malicious-activity | G1040 Play |
Tags
play discovery ransomware spyware stealerSample information
- Filenames
- 2026-03-11_c6fd44e210047a19d582d60aecdc9e69_amadey_cobalt-strike_elex_play
- MD5
c6fd44e210047a19d582d60aecdc9e69- SHA-1
64518ecef0e25637cd26bda8f7f1630515d6fe7b- SHA-256
f6cc8d5c60534af20426ef69e61b2ec8d2001c4014cb18000fef7b55811d3b50- SHA-512
4d275d70d5ddd0c7de10119813dd45751e86f2cab80d2862a39218d5cb222d71be648e7361e2e186da1e63b30963906a111bc95782e0cc5b0bb9480767e421be- First indexed
- 2026-03-11 12:00:33
- Last updated
- 2026-06-22 01:36:40
Antivirus detections
| Engine | Detection |
|---|---|
| ALYac | Gen:Variant.Ransom.Play.29 |
| APEX | Malicious |
| AVG | Win32:MalwareX-gen [Ransom] |
| AhnLab-V3 | Trojan/Win.Generic.C5312777 |
| Alibaba | Ransom:Win32/MalwareX.93472cb9 |
| Antiy-AVL | Trojan[Ransom]/Win32.PLAY |
| Arcabit | Trojan.Ransom.Play.29 |
| Avast | Win32:MalwareX-gen [Ransom] |
| Avira | TR/Crypt.XPACK.Gen2 |
| BitDefender | Gen:Variant.Ransom.Play.29 |
| Bkav | W32.AIDetectMalware |
| CAT-QuickHeal | Ransom.Play.S30221327 |
| CTX | exe.ransomware.play |
| ClamAV | Win.Ransomware.Zard-9993378-0 |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cylance | Unsafe |
| Cynet | Malicious (score: 100) |
| DeepInstinct | MALICIOUS |
| DrWeb | Trojan.Encoder.36812 |
| ESET-NOD32 | Win32/Filecoder.PLAY.B trojan |
| Elastic | malicious (high confidence) |
| Emsisoft | Gen:Variant.Ransom.Play.29 (B) |
| F-Secure | Trojan.TR/Crypt.XPACK.Gen2 |
| Fortinet | W32/Filecoder.PLAY!tr.ransom |
| GData | Gen:Variant.Ransom.Play.29 |
| Detected | |
| Gridinsoft | Ransom.Win32.Gen.oa!s1 |
| Ikarus | Trojan-Ransom.Play |
| Jiangmin | Trojan.Agent.eizj |
| K7AntiVirus | Ransomware ( 005d981a1 ) |
| K7GW | Ransomware ( 005d981a1 ) |
| Kaspersky | HEUR:Trojan.Win32.Agentb.gen |
| Kingsoft | Win32.Trojan.Agentb.gen |
| Lionic | Trojan.Win32.PlayCrypt.4!c |
| Malwarebytes | Ransom.Play |
| MaxSecure | Trojan.Malware.195909361.susgen |
| McAfeeD | Real Protect-LS!C6FD44E21004 |
| MicroWorld-eScan | Gen:Variant.Ransom.Play.29 |
| Microsoft | Ransom:Win32/Play.D |
| NANO-Antivirus | Trojan.Win32.Encoder.jtwpay |
| Paloalto | generic.ml |
| Panda | Trj/GdSda.A |
| Rising | Ransom.Play!8.166FA (TFE:5:4FGIOCKkokJ) |
| Sangfor | Trojan.Win32.Save.a |
| SentinelOne | Static AI - Malicious PE |
| Skyhigh | GenericRXUV-CR!C6FD44E21004 |
| Sophos | Mal/PlayCrypt-A |
| Symantec | Ransom.PlayCrypt!g2 |
| TACHYON | Ransom/W32.Play.513536 |
| Tencent | Trojan-Ransom.Win32.Agent.kf |
| Trapmine | suspicious.low.ml.score |
| TrellixENS | GenericRXUV-CR!C6FD44E21004 |
| TrendMicro | Ransom.Win32.PLAYDE.SMYXCK4 |
| TrendMicro-HouseCall | Ransom.Win32.PLAYDE.SMYXCK4 |
| VBA32 | Trojan.Agentb |
| VIPRE | Gen:Variant.Ransom.Play.29 |
| Varist | W32/Filecoder.NV.gen!Eldorado |
| ViRobot | Trojan.Win.Z.Play.513536.O |
| VirIT | Trojan.Win32.Genus.QKT |
| Zillya | Trojan.Filecoder.Win32.27724 |
| ZoneAlarm | Mal/PlayCrypt-A |
| alibabacloud | Ransomware:Win/Play.3b5d0bd1 |
| huorong | Ransom/LockFile.mi |