6fb7c5d8339b7fd4e3a38cf75d1aa126d0f8f7e04c4076f649ad3a5938e871b5

General

Target
2026-06-30_690eed10025c6572c3754930f1606da1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry
Size 1.1MB
Sample260630-1ts5lsat2v
SHA256 6fb7c5d8339b7fd4e3a38cf75d1aa126d0f8f7e04c4076f649ad3a5938e871b5
MD5 690eed10025c6572c3754930f1606da1
SHA1 a9714a572673559bebe0edf709cbe629b83cee8b
SHA512 290880b7565f408393d1768a473b3421ce390e7298c81f89167014d719585df20d47822e886360f951edff5ab1851898f590017241ad92339df85be8a9b3bb8c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaiTNnD5TvinrmC:A3k03kHRJd56rX
TLSH
T18D356B03A6980FE8D11F81749A964662EA777C125F2093CF1354AE153F72BD0AF3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-30_690eed10025c6572c3754930f1606da1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry
- Size 1.1MB
- SHA256 6fb7c5d8339b7fd4e3a38cf75d1aa126d0f8f7e04c4076f649ad3a5938e871b5
- MD5 690eed10025c6572c3754930f1606da1
- SHA1 a9714a572673559bebe0edf709cbe629b83cee8b
- SHA512 290880b7565f408393d1768a473b3421ce390e7298c81f89167014d719585df20d47822e886360f951edff5ab1851898f590017241ad92339df85be8a9b3bb8c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaiTNnD5TvinrmC:A3k03kHRJd56rX
- TLSH
  T18D356B03A6980FE8D11F81749A964662EA777C125F2093CF1354AE153F72BD0AF3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

aspackv2 discovery persistence spyware stealer adware ransomware
- Detects executables packed with ASPack
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2