General
- Target 2026-04-21_49f6630de4512d7553a9452a0a16a854_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_remcos_vidar_wannacry
- Size 7.5MB
- Sample260421-gr7qfacv8v
- SHA256 2ba317451df19bfc7e61db0d4df7c8f92c2552a213f98c7b09f45f249240e335
- MD5 49f6630de4512d7553a9452a0a16a854
- SHA1 326e1366ccd2d6eb5b5358174adaa52ce63317d2
- SHA512 f1b76a8c9b6c1106e40f4704eb0f0078ae5951d57a14665fcc7d7bc207b2c97b30b68fab58ae60660c8a2c0b56308cec4db48ab722e82ff9e816a09128bc0d42
- SSDEEP 98304:Pe5x6c1/e5x6c1ze5x6c1/e5x6c1MMee5x6c1/e5x6c1ze5x6c1623SKb:IkQkoMFkQGob
- TLSH T168868D12F69140F5D7AA1930446A6736EA36FE060B15CBCB9354DE693E332C0ED3636B
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-21_49f6630de4512d7553a9452a0a16a854_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_remcos_vidar_wannacry.exe
Resource
win10v2004-20260130-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-21_49f6630de4512d7553a9452a0a16a854_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_remcos_vidar_wannacry.exe
Resource
win11-20260130-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-04-21_49f6630de4512d7553a9452a0a16a854_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_remcos_vidar_wannacry
- Size 7.5MB
- SHA256 2ba317451df19bfc7e61db0d4df7c8f92c2552a213f98c7b09f45f249240e335
- MD5 49f6630de4512d7553a9452a0a16a854
- SHA1 326e1366ccd2d6eb5b5358174adaa52ce63317d2
- SHA512 f1b76a8c9b6c1106e40f4704eb0f0078ae5951d57a14665fcc7d7bc207b2c97b30b68fab58ae60660c8a2c0b56308cec4db48ab722e82ff9e816a09128bc0d42
- SSDEEP 98304:Pe5x6c1/e5x6c1ze5x6c1/e5x6c1MMee5x6c1/e5x6c1ze5x6c1623SKb:IkQkoMFkQGob
- TLSH T168868D12F69140F5D7AA1930446A6736EA36FE060B15CBCB9354DE693E332C0ED3636B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Sets desktop wallpaper using registry