2026-06-28_4cfc3ccda3bb5c50107d73a1fbd89e5a_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry

General

Target
2026-06-28_4cfc3ccda3bb5c50107d73a1fbd89e5a_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry
Size 2.0MB
Sample260628-2p7ymsgv9l
SHA256 545e0d655a0f78caca6b19c1ea930a6f36463c32a008ffe920a509206fbc2fb6
MD5 4cfc3ccda3bb5c50107d73a1fbd89e5a
SHA1 81024022364a5faf6983fd48937e454a23c840fc
SHA512 4bc939f0da2f0a25db5fa8e17b954bd75867f40f0987cd591791a89ee68207a132933eb52c0f77959167be49cc729305dc8c144e6b08bdfac070825242888d7f
SSDEEP 24576:KIifqFu1//IifqFuyDA54GXE0Le5ji0hmxNrMYExqatgl8bdaMYwZCUwbeZwbD59:WqFgqFUHEPji0AjkqatglF56r
TLSH
T1E4A51746F2944AA5C06F8134CA965266FA737C410FA097DB13D4FB3D3F326D09AB6623
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-28_4cfc3ccda3bb5c50107d73a1fbd89e5a_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry

2026-06-28_4cfc3ccda3bb5c50107d73a1fbd89e5a_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry

.exe 2.0MB

IMPHASH b941ddedcc51e5706d41335adb4e6b2a
SHA256 545e0d655a0f78caca6b19c1ea930a6f36463c32a008ffe920a509206fbc2fb6
MD5 4cfc3ccda3bb5c50107d73a1fbd89e5a
SHA1 81024022364a5faf6983fd48937e454a23c840fc
SHA512 4bc939f0da2f0a25db5fa8e17b954bd75867f40f0987cd591791a89ee68207a132933eb52c0f77959167be49cc729305dc8c144e6b08bdfac070825242888d7f
SSDEEP 24576:KIifqFu1//IifqFuyDA54GXE0Le5ji0hmxNrMYExqatgl8bdaMYwZCUwbeZwbD59:WqFgqFUHEPji0AjkqatglF56r
TLSH
T1E4A51746F2944AA5C06F8134CA965266FA737C410FA097DB13D4FB3D3F326D09AB6623
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths