General
- Target 2026-06-25_515b19b3d2450e00f42c465b2ee180e3_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry
- Size 930KB
- Sample260629-2dcclahx8n
- SHA256 a3ac4eeb82acaa73a35dcfae5d81c8da3924e0194fd81df22f40c702057d7a81
- MD5 515b19b3d2450e00f42c465b2ee180e3
- SHA1 dbc7fbe9e73bd9ca840182d4b8a673ea6959bb2b
- SHA512 f7d064f21cf5900c1ec5e618329a6804c76c7108ed6882bb6ee6b445974c2a3de5cc8a6d7020bcbb40dafa9a527f251874aab3e88aaead0433f6b82a3c04a115
- SSDEEP 24576:Yl98b8GSW4tyHqD5Tvinrmh5jcAkSYqyE:w56rapYq
- TLSH T16C152816E6648F65D03BC0B5C5D2569AEA733C465F3087CB1349AE283F237D2993A363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-25_515b19b3d2450e00f42c465b2ee180e3_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
Resource
win10v2004-20260513-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-25_515b19b3d2450e00f42c465b2ee180e3_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
Resource
win11ltsc2024-20260629-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-25_515b19b3d2450e00f42c465b2ee180e3_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry
- Size 930KB
- SHA256 a3ac4eeb82acaa73a35dcfae5d81c8da3924e0194fd81df22f40c702057d7a81
- MD5 515b19b3d2450e00f42c465b2ee180e3
- SHA1 dbc7fbe9e73bd9ca840182d4b8a673ea6959bb2b
- SHA512 f7d064f21cf5900c1ec5e618329a6804c76c7108ed6882bb6ee6b445974c2a3de5cc8a6d7020bcbb40dafa9a527f251874aab3e88aaead0433f6b82a3c04a115
- SSDEEP 24576:Yl98b8GSW4tyHqD5Tvinrmh5jcAkSYqyE:w56rapYq
- TLSH T16C152816E6648F65D03BC0B5C5D2569AEA733C465F3087CB1349AE283F237D2993A363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.