6151ed52225fbb282517c7f1245564ee810c8b5a71d7bbdabb519ddc1afda8df

General

Target
2026-07-01_1433e85ac77729c91d3a8e223b2e5717_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry
Size 2.2MB
Sample260701-mntbjad13y
SHA256 6151ed52225fbb282517c7f1245564ee810c8b5a71d7bbdabb519ddc1afda8df
MD5 1433e85ac77729c91d3a8e223b2e5717
SHA1 347dd72859e913fb3f311d862eef7b12df7c0df3
SHA512 64186ce878867cf1a0ac2e4c9c57dd5dbb8e0b983b4813df27c83315cb2b3b6b8fb573894e56974177cba099e079f0e29082c8f6b50f59f7fd715c51ecaf50b5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiTPe2yqD5TvinrmbSw9EFZe0p4Ek4/:A3k03kHRJf56rneW4SkZP4sz9MbE56rX
TLSH
T19EB52916B6B84B62D06BC079C5D66A56FA333C465F2087CB0344AF283F277D19A39367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-01_1433e85ac77729c91d3a8e223b2e5717_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry
- Size 2.2MB
- SHA256 6151ed52225fbb282517c7f1245564ee810c8b5a71d7bbdabb519ddc1afda8df
- MD5 1433e85ac77729c91d3a8e223b2e5717
- SHA1 347dd72859e913fb3f311d862eef7b12df7c0df3
- SHA512 64186ce878867cf1a0ac2e4c9c57dd5dbb8e0b983b4813df27c83315cb2b3b6b8fb573894e56974177cba099e079f0e29082c8f6b50f59f7fd715c51ecaf50b5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiTPe2yqD5TvinrmbSw9EFZe0p4Ek4/:A3k03kHRJf56rneW4SkZP4sz9MbE56rX
- TLSH
  T19EB52916B6B84B62D06BC079C5D66A56FA333C465F2087CB0344AF283F277D19A39367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

aspackv2 discovery persistence spyware stealer adware
- Detects executables packed with ASPack
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2