85f88cb0d0899a6d4c5a385dfdd3967e8841890bea562c1866c563b10a52d6d5

General

Target
2026-06-25_053a5792480b727b996044b6d87355e0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry
Size 2.8MB
Sample260630-aqgz3aay91
SHA256 85f88cb0d0899a6d4c5a385dfdd3967e8841890bea562c1866c563b10a52d6d5
MD5 053a5792480b727b996044b6d87355e0
SHA1 42783b291a0866240243fcf1880a41c41c640c19
SHA512 649d3b929014a3f87b002401f6fb180044323fd35fbc091291f39224828125e563225b3cddc195da724c89d27b96ac2eed7e1b823b1628acc57d1d5706f5670d
SSDEEP 49152:A3k03kHRJARJ356rheW4SkZP4sz9MbqPji0AjdRJO:A3k03kHR+Rer1fkZcgjo5RM
TLSH
T1E7D52A16F6B84762D0B7C079C9D6AA56FA323C410F308BDB0345BB282E377D59A35726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-25_053a5792480b727b996044b6d87355e0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry
- Size 2.8MB
- SHA256 85f88cb0d0899a6d4c5a385dfdd3967e8841890bea562c1866c563b10a52d6d5
- MD5 053a5792480b727b996044b6d87355e0
- SHA1 42783b291a0866240243fcf1880a41c41c640c19
- SHA512 649d3b929014a3f87b002401f6fb180044323fd35fbc091291f39224828125e563225b3cddc195da724c89d27b96ac2eed7e1b823b1628acc57d1d5706f5670d
- SSDEEP 49152:A3k03kHRJARJ356rheW4SkZP4sz9MbqPji0AjdRJO:A3k03kHR+Rer1fkZcgjo5RM
- TLSH
  T1E7D52A16F6B84762D0B7C079C9D6AA56FA323C410F308BDB0345BB282E377D59A35726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

aspackv2 discovery persistence adware spyware stealer
- Detects executables packed with ASPack
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2