2026-06-30_89d2dc7df084b31f83f3d3283c8c82f8_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-30_89d2dc7df084b31f83f3d3283c8c82f8_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry
Size 778KB
Sample260701-ejblxsdy8p
SHA256 06985a9231579e0c7edf30875426efcf44e50b1cc3d26fd587e05ca240cdb796
MD5 89d2dc7df084b31f83f3d3283c8c82f8
SHA1 61bf85dd928dd3cfb1f7cbb2e6ad6f7cf26c44f9
SHA512 5b6950576861f38bf495fefc4cef9f2b9758dcf93a836704a62b969a01f74a050b90f57b80948487ff8194c7ec68ba9ec932163baafc65b6894bcfb43357888c
SSDEEP 12288:n8j3auNs9kF5ECv+BeDuUlEqatglsLbex:8zauNs9kF5Exqatgl8bex
TLSH
T15205E841BBF84055F1B397729EB785669A72BCA55F32D24F2354421E0E32B80EE31B36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-30_89d2dc7df084b31f83f3d3283c8c82f8_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry

File Explorer

2026-06-30_89d2dc7df084b31f83f3d3283c8c82f8_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry

.exe 778KB

2026-06-30_89d2dc7df084b31f83f3d3283c8c82f8_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry

IMPHASH a0134d609f618d627a963155ef434726
SHA256 06985a9231579e0c7edf30875426efcf44e50b1cc3d26fd587e05ca240cdb796
MD5 89d2dc7df084b31f83f3d3283c8c82f8
SHA1 61bf85dd928dd3cfb1f7cbb2e6ad6f7cf26c44f9
SHA512 5b6950576861f38bf495fefc4cef9f2b9758dcf93a836704a62b969a01f74a050b90f57b80948487ff8194c7ec68ba9ec932163baafc65b6894bcfb43357888c
SSDEEP 12288:n8j3auNs9kF5ECv+BeDuUlEqatglsLbex:8zauNs9kF5Exqatgl8bex
TLSH
T15205E841BBF84055F1B397729EB785669A72BCA55F32D24F2354421E0E32B80EE31B36
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

71760

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\T\M\BuildResults\bin\Release\Plug_ins\pi_brokers\32BitMAPIBroker.pdb

kernel32

WaitForSingleObject CreateFileW DisconnectNamedPipe GetLastError SetEvent CloseHandle CreateThread ResetEvent GetProcAddress LocalFree DeleteCriticalSection GetCurrentProcessId GetModuleHandleW TransactNamedPipe GetFileType CreateEventA WaitNamedPipeW ConnectNamedPipe LocalAlloc GetCurrentThreadId VerSetConditionMask VerifyVersionInfoW CreateNamedPipeA WaitForMultipleObjects PeekNamedPipe OpenProcess GetOverlappedResult FlushFileBuffers InitializeCriticalSection LoadLibraryA FreeLibrary WideCharToMultiByte Sleep GetCommandLineA MultiByteToWideChar TlsAlloc TlsGetValue TlsSetValue TlsFree CreateSemaphoreA GetCurrentThread OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive CreateMutexW LeaveCriticalSection CreateNamedPipeW WriteFile GetCurrentProcess EnterCriticalSection SetLastError SetNamedPipeHandleState InitializeCriticalSectionEx ReadFile

user32

GetMessageA DispatchMessageA TranslateMessage

advapi32

OpenThreadToken OpenProcessToken GetTokenInformation ConvertSidToStringSidA ConvertStringSecurityDescriptorToSecurityDescriptorA

shell32

SHGetFileInfoW

ole32

CoWaitForMultipleHandles

msvcp140

?_Xlength_error@std@@YAXPBD@Z

vcruntime140

_except_handler4_common memchr __current_exception_context memmove memset __CxxFrameHandler3 __current_exception memcpy __std_exception_destroy __std_exception_copy __std_terminate memcmp _CxxThrowException _purecall

api-ms-win-crt-runtime-l1-1-0

_cexit _seh_filter_exe _set_app_type _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e exit _exit _c_exit _register_thread_local_exe_atexit_callback _register_onexit_function terminate _controlfp_s _set_invalid_parameter_handler _invalid_parameter_noinfo_noreturn _errno _invalid_parameter_noinfo _crt_atexit _initialize_onexit_table

api-ms-win-crt-string-l1-1-0

strlen strtok_s wcstok_s wcscat_s wcscpy_s

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath_s

api-ms-win-crt-heap-l1-1-0

free _callnewh malloc _set_new_mode

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode __stdio_common_vswscanf __stdio_common_vsnwprintf_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-30_89d2dc7df084b31f83f3d3283c8c82f8_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry

kernel32

user32

advapi32

shell32

ole32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic