General
- Target 2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry
- Size 778KB
- Sample260505-n99fbae121
- SHA256 00dac08f58b2594ef94d9e2386cdc8fcb4571a6311efdbfd380afac0a533e29d
- MD5 57a18cf6b4faaa7a00d8e3d056c1e127
- SHA1 9644a5ff199eee37a4cdd6c7870493b3b84fe004
- SHA512 b133d0e7bdbdbb55e2f3ab2201334a4d728c38d5a19cbb40ad8903ac9a33eb090af9b9f9499b7ba97375619ca6a37cca7e7c20d6ea7d911bdefe17c9efbcdf8b
- SSDEEP 24576:w4R5CIH/7o4R5CIH/70x20GU20GShhe8a9dsTcQ7Iwo0:wabH/MabH/WNTyV9dsTh7Iw
- TLSH T1CB053B22A7905096E4B3C57468B5821AAA357D7107609FDFB3C0770E1F32AD2BDB4B1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260130-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260130-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-05_57a18cf6b4faaa7a00d8e3d056c1e127_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry
- Size 778KB
- SHA256 00dac08f58b2594ef94d9e2386cdc8fcb4571a6311efdbfd380afac0a533e29d
- MD5 57a18cf6b4faaa7a00d8e3d056c1e127
- SHA1 9644a5ff199eee37a4cdd6c7870493b3b84fe004
- SHA512 b133d0e7bdbdbb55e2f3ab2201334a4d728c38d5a19cbb40ad8903ac9a33eb090af9b9f9499b7ba97375619ca6a37cca7e7c20d6ea7d911bdefe17c9efbcdf8b
- SSDEEP 24576:w4R5CIH/7o4R5CIH/70x20GU20GShhe8a9dsTcQ7Iwo0:wabH/MabH/WNTyV9dsTh7Iw
- TLSH T1CB053B22A7905096E4B3C57468B5821AAA357D7107609FDFB3C0770E1F32AD2BDB4B1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Disables service(s)
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1