General
- Target 2026-06-30_049f43c8e28528b0b034d963e097ac5f_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry
- Size 1.4MB
- Sample260701-hdqqfaat9w
- SHA256 788d4b7c187dc375843d067e5d333bc3f167b14be743a129460bec3fccb9e82a
- MD5 049f43c8e28528b0b034d963e097ac5f
- SHA1 c2be4304f7b2f55d82b94a44364c0d5762f61c99
- SHA512 726e5f8ca82b8c5805006e7dbb480364f6ce6c7a823fb57c4caee883e29d1edf7d1ab033178fc38df7bf2afa3e4f429743b88fdf683c3d287d45ac5b78117572
- SSDEEP 24576:iEl45jcAkSYqyEgMD5TvinrmbLPmYTqMi8CtBd2QHCHmTBW5M:ypYqn56rOqJtb2I
- TLSH T1C8650815F6A48B61D07BC079C9D2969AEA333C814F308BCB1285BB783E376D59536732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-30_049f43c8e28528b0b034d963e097ac5f_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
Resource
win10v2004-20260513-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-30_049f43c8e28528b0b034d963e097ac5f_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
Resource
win11ltsc2024-20260629-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-30_049f43c8e28528b0b034d963e097ac5f_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry
- Size 1.4MB
- SHA256 788d4b7c187dc375843d067e5d333bc3f167b14be743a129460bec3fccb9e82a
- MD5 049f43c8e28528b0b034d963e097ac5f
- SHA1 c2be4304f7b2f55d82b94a44364c0d5762f61c99
- SHA512 726e5f8ca82b8c5805006e7dbb480364f6ce6c7a823fb57c4caee883e29d1edf7d1ab033178fc38df7bf2afa3e4f429743b88fdf683c3d287d45ac5b78117572
- SSDEEP 24576:iEl45jcAkSYqyEgMD5TvinrmbLPmYTqMi8CtBd2QHCHmTBW5M:ypYqn56rOqJtb2I
- TLSH T1C8650815F6A48B61D07BC079C9D2969AEA333C814F308BCB1285BB783E376D59536732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.