2026-04-17_8f98b526910c85462a77b00e50cf0184_cobalt-strike_elex_njrat_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-17_8f98b526910c85462a77b00e50cf0184_cobalt-strike_elex_njrat_wannacry
Size 535KB
Sample260417-ehhc3shy3t
SHA256 38b996fa878644232e23acd5e85128bf5361449f262c45a9a9ec84b68104a62b
MD5 8f98b526910c85462a77b00e50cf0184
SHA1 6f78da74400deddd3ecaee18e8d9825ce9aa5965
SHA512 9c9b5b4e3c8ccd24fdda8127888b70d5ea9c6aa604fa3c6264b463896aa296dac2c9d995719776cc98578811ba6ab3759a01cd0a20393a93191a49df12e2df14
SSDEEP 3072:+GC43DksD+XZVpFr00000000000000000000000000000000000000000000000f:+GC43NaV7gSqer5+np
TLSH
T1F9C42BD5768262A3CB500630E00F0FB8627E6CD7811F9515A2F3BB565B742199EEC2BF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-17_8f98b526910c85462a77b00e50cf0184_cobalt-strike_elex_njrat_wannacry

File Explorer

2026-04-17_8f98b526910c85462a77b00e50cf0184_cobalt-strike_elex_njrat_wannacry

.exe 535KB

2026-04-17_8f98b526910c85462a77b00e50cf0184_cobalt-strike_elex_njrat_wannacry

IMPHASH d00a58aa1c2c5ec1881a93e0ccf8996a
SHA256 38b996fa878644232e23acd5e85128bf5361449f262c45a9a9ec84b68104a62b
MD5 8f98b526910c85462a77b00e50cf0184
SHA1 6f78da74400deddd3ecaee18e8d9825ce9aa5965
SHA512 9c9b5b4e3c8ccd24fdda8127888b70d5ea9c6aa604fa3c6264b463896aa296dac2c9d995719776cc98578811ba6ab3759a01cd0a20393a93191a49df12e2df14
SSDEEP 3072:+GC43DksD+XZVpFr00000000000000000000000000000000000000000000000f:+GC43NaV7gSqer5+np
TLSH
T1F9C42BD5768262A3CB500630E00F0FB8627E6CD7811F9515A2F3BB565B742199EEC2BF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

33158

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mfc42

ord2385 ord5163 ord6374 ord4353 ord5280 ord3798 ord4837 ord4441 ord2648 ord2055 ord6376 ord3749 ord5065 ord1727 ord5261 ord2446 ord2124 ord5277 ord4627 ord4425 ord3597 ord324 ord4234 ord1146 ord5241 ord540 ord6215 ord4160 ord2863 ord2379 ord755 ord470 ord1105 ord3337 ord3811 ord6648 ord6779 ord5710 ord6877 ord860 ord823 ord4224 ord537 ord535 ord5856 ord858 ord941 ord4407 ord1775 ord4078 ord6052 ord4710 ord4998 ord4853 ord4376 ord5265 ord1134 ord2621 ord2514 ord800 ord1576 ord641 ord815 ord825 ord561 ord3738 ord4424 ord4622 ord4080 ord3079 ord3825 ord3831 ord3830 ord2976 ord3081 ord2985 ord3262 ord3136 ord4465 ord3259 ord3147 ord2982 ord5714 ord5289 ord5307 ord4698 ord4079 ord2725 ord5302 ord5300 ord3346 ord2396 ord5199 ord1089 ord3922 ord5731 ord2512 ord2554 ord4486 ord6375 ord4274 ord1168 ord4673

msvcrt

_except_handler3 __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr __getmainargs _acmdln _XcptFilter _exit _onexit _setmbcp _strcmpi _initterm _controlfp __CxxFrameHandler exit _mbscmp strstr fclose fopen sprintf sscanf mbstowcs fwrite _ftol _endthread __dllonexit _beginthread strncpy atoi

kernel32

Process32First CloseHandle DeleteFileA SetFileAttributesA ExitProcess CopyFileA Sleep FindFirstFileA FindNextFileA FindClose GetModuleFileNameA CreateToolhelp32Snapshot MapViewOfFile GetVersionExA LocalFree GetProcAddress LoadLibraryA lstrcatA GetTickCount WinExec CreateProcessA GetStartupInfoA GetModuleHandleA GetCurrentProcess GetLogicalDrives GetDriveTypeA UpdateResourceA SizeofResource LockResource LoadResource FindResourceA EndUpdateResourceA FreeLibrary EnumResourceNamesA LoadLibraryExA BeginUpdateResourceA UnmapViewOfFile GetWindowsDirectoryA GetSystemDirectoryA

user32

IsIconic DrawIcon PostMessageA EnumWindows GetClientRect GetSystemMetrics LoadIconA SendMessageA AppendMenuA GetSystemMenu GetParent GetWindowTextA GetWindowLongA EnableWindow ExitWindowsEx

advapi32

RegEnumValueA RegOpenKeyExA RegQueryValueExA GetSecurityInfo SetEntriesInAclA SetSecurityInfo OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyA RegSetValueExA RegCloseKey RegCreateKeyA RegEnumKeyA

shell32

ShellExecuteA SHGetSpecialFolderPathA

ws2_32

send recv WSASocketA connect htons select sendto socket inet_addr WSAStartup gethostname gethostbyname inet_ntoa WSACleanup closesocket

netapi32

NetShareEnum NetUseDel NetUseAdd NetApiBufferFree

mpr

WNetCancelConnection2A

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-17_8f98b526910c85462a77b00e50cf0184_cobalt-strike_elex_njrat_wannacry

mfc42

msvcrt

kernel32

user32

advapi32

shell32

ws2_32

netapi32

mpr

generic