2026-05-29_94442a1fc942c28d9fd1b6bbc0f4fc2f_amadey_cobalt-strike_hijackloader_remcos_satacom_wannacry

General

Target
2026-05-29_94442a1fc942c28d9fd1b6bbc0f4fc2f_amadey_cobalt-strike_hijackloader_remcos_satacom_wannacry
Size 314KB
Sample260529-mkap1shs8q
SHA256 ca4e25d0cbeb8a119fcc49a02d7cda3229071c5a95c92dea659e9188197b8f61
MD5 94442a1fc942c28d9fd1b6bbc0f4fc2f
SHA1 54e0ce538622b7211b438c6fe1014c61b5134ffb
SHA512 39b9553615d323c5ff378ef6e8f53564c8ecc929c2814e44815b067e1c12bd749d72148d7abfb0cd549a991af380814fe36745fb13ad992fde988ea35a8bff7c
SSDEEP 6144:PCfTXkxqDbVC9TY62SYdb4fnGZLknnj1PivJo/qi+k:PCa062SYUcknngvC3R
TLSH
T13B644902B7F404A6F5F34B3098F18652AA7AFC619E31CA9F0254525E2E31791DE35B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-29_94442a1fc942c28d9fd1b6bbc0f4fc2f_amadey_cobalt-strike_hijackloader_remcos_satacom_wannacry

2026-05-29_94442a1fc942c28d9fd1b6bbc0f4fc2f_amadey_cobalt-strike_hijackloader_remcos_satacom_wannacry

.exe 314KB

IMPHASH 3325e12181a2525dc192101472612d6a
SHA256 ca4e25d0cbeb8a119fcc49a02d7cda3229071c5a95c92dea659e9188197b8f61
MD5 94442a1fc942c28d9fd1b6bbc0f4fc2f
SHA1 54e0ce538622b7211b438c6fe1014c61b5134ffb
SHA512 39b9553615d323c5ff378ef6e8f53564c8ecc929c2814e44815b067e1c12bd749d72148d7abfb0cd549a991af380814fe36745fb13ad992fde988ea35a8bff7c
SSDEEP 6144:PCfTXkxqDbVC9TY62SYdb4fnGZLknnj1PivJo/qi+k:PCa062SYUcknngvC3R
TLSH
T13B644902B7F404A6F5F34B3098F18652AA7AFC619E31CA9F0254525E2E31791DE35B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

2

Major OS version

5

Entry point

10852

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\CB\11X_MainQ\BuildResults\bin\Release\chrome_wow_helper.pdb