General
- Target 2026-07-02_0585fd2c07158064c2f9b6cd37ab4a59_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry
- Size 1.2MB
- Sample260702-1f65bacs6j
- SHA256 9b3a6dc0ea1680f6659b5bb42a6ac7f935b059d6aeec48b28d5a4a2922c5ef3f
- MD5 0585fd2c07158064c2f9b6cd37ab4a59
- SHA1 dc85fabfb18548c1236458b6d5e1c30d356b413b
- SHA512 4fbed279b6f4e49568f45ac104c571fe46377cec5548102e0e489c9d2b9290c390ce502eb79a1e6373dc05e2ba5a6c9d2642c0961b4cf79abbf95f049ab8063a
- SSDEEP 24576:rTZe0p4Ek4niOkl/A04szE87JKTvmLLRCD5TvinrmC:JeW4SkZP4sz9Mbd56rX
- TLSH T1BB45F655F1B88B23D0BBD079C8D6AA99F9333C810F208BDB0245BB287E376D59535726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-02_0585fd2c07158064c2f9b6cd37ab4a59_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
Resource
win10v2004-20260513-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-02_0585fd2c07158064c2f9b6cd37ab4a59_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
Resource
win11ltsc2024-20260629-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-02_0585fd2c07158064c2f9b6cd37ab4a59_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry
- Size 1.2MB
- SHA256 9b3a6dc0ea1680f6659b5bb42a6ac7f935b059d6aeec48b28d5a4a2922c5ef3f
- MD5 0585fd2c07158064c2f9b6cd37ab4a59
- SHA1 dc85fabfb18548c1236458b6d5e1c30d356b413b
- SHA512 4fbed279b6f4e49568f45ac104c571fe46377cec5548102e0e489c9d2b9290c390ce502eb79a1e6373dc05e2ba5a6c9d2642c0961b4cf79abbf95f049ab8063a
- SSDEEP 24576:rTZe0p4Ek4niOkl/A04szE87JKTvmLLRCD5TvinrmC:JeW4SkZP4sz9Mbd56rX
- TLSH T1BB45F655F1B88B23D0BBD079C8D6AA99F9333C810F208BDB0245BB287E376D59535726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.