General
- Target 2026-06-25_54e69af837c5fd068747117357795669_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry
- Size 1.5MB
- Sample260629-2amn6agw5w
- SHA256 2a6be5eb8825c27137bcde98310bfb0d790bb34f4f970527c9f009195f8ec0a0
- MD5 54e69af837c5fd068747117357795669
- SHA1 a49f5d7d0312fc43b78165adc02963582becc9d8
- SHA512 97c76a73d308462f8a1b460a3f217e17e4e919b691f14eef3aa146400ff8043eef38428018bb5bda2036472c6389c247c4f0b3f82853fe817bd0f405c6e0190a
- SSDEEP 24576:aGSW4TjqqpCcMJljaMD5TvinrmGZe0p4Ek4niOkl/A04szE87JKTvm:zRJn56rbeW4SkZP4sz9Mb
- TLSH T139651915F5B88B22D0BBC075C8D66A99FA333C455F208BDB0245BB283E377D59A35326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-25_54e69af837c5fd068747117357795669_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
Resource
win10v2004-20260513-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-25_54e69af837c5fd068747117357795669_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
Resource
win11ltsc2024-20260629-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-25_54e69af837c5fd068747117357795669_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry
- Size 1.5MB
- SHA256 2a6be5eb8825c27137bcde98310bfb0d790bb34f4f970527c9f009195f8ec0a0
- MD5 54e69af837c5fd068747117357795669
- SHA1 a49f5d7d0312fc43b78165adc02963582becc9d8
- SHA512 97c76a73d308462f8a1b460a3f217e17e4e919b691f14eef3aa146400ff8043eef38428018bb5bda2036472c6389c247c4f0b3f82853fe817bd0f405c6e0190a
- SSDEEP 24576:aGSW4TjqqpCcMJljaMD5TvinrmGZe0p4Ek4niOkl/A04szE87JKTvm:zRJn56rbeW4SkZP4sz9Mb
- TLSH T139651915F5B88B22D0BBC075C8D66A99FA333C455F208BDB0245BB283E377D59A35326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.