2026-05-27_1f44ee7966c5698bd5af4cbb26c6be04_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry

General

Target
2026-05-27_1f44ee7966c5698bd5af4cbb26c6be04_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry
Size 3.4MB
Sample260527-tc7hcacz9v
SHA256 38563e82a4dda2bbba99565f5b0c1cf5eb5d761b9fbc81ecaff87ff38b592a44
MD5 1f44ee7966c5698bd5af4cbb26c6be04
SHA1 aefe4f6298eb1dffd3fac2c15dfb973ff9ce4297
SHA512 e73232bf0fcdebac0312e353e4dd199f6235d5465b0b916e49d5aacb81955ad70eb31f8cebc68565a2ece2eec20728f70efa12f15e589f6a8407cf0f8b940071
SSDEEP 49152:Sc8MNFI7c8MNFdv9MN/IabjKoh9WsQeW4SkZP4sz9Mb41lkWu0yPqJtb2IdqJtbH:ScGcX90IabjKoh9Ws8fkZc41lkNPc
TLSH
T123F50911B7B88722E0B3C1BAD5E2A75AED723C411B3186CB5245B76C1E33AD1D636732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-27_1f44ee7966c5698bd5af4cbb26c6be04_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry

2026-05-27_1f44ee7966c5698bd5af4cbb26c6be04_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry

.exe 3.4MB

IMPHASH b941ddedcc51e5706d41335adb4e6b2a
SHA256 38563e82a4dda2bbba99565f5b0c1cf5eb5d761b9fbc81ecaff87ff38b592a44
MD5 1f44ee7966c5698bd5af4cbb26c6be04
SHA1 aefe4f6298eb1dffd3fac2c15dfb973ff9ce4297
SHA512 e73232bf0fcdebac0312e353e4dd199f6235d5465b0b916e49d5aacb81955ad70eb31f8cebc68565a2ece2eec20728f70efa12f15e589f6a8407cf0f8b940071
SSDEEP 49152:Sc8MNFI7c8MNFdv9MN/IabjKoh9WsQeW4SkZP4sz9Mb41lkWu0yPqJtb2IdqJtbH:ScGcX90IabjKoh9Ws8fkZc41lkNPc
TLSH
T123F50911B7B88722E0B3C1BAD5E2A75AED723C411B3186CB5245B76C1E33AD1D636732
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths