37282739049c30c4a60109b19e9605bb521bb4aba4ea5416236a4bb07f6f6f27

General

Target
2026-07-02_f1579febf01552b32d496f6be6ccd5d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry
Size 1.8MB
Sample260702-mtckzags51
SHA256 37282739049c30c4a60109b19e9605bb521bb4aba4ea5416236a4bb07f6f6f27
MD5 f1579febf01552b32d496f6be6ccd5d8
SHA1 8eaa3925914674027587b325dcced0d0d123eaac
SHA512 4c2765849bbc1cfa1ef8ebd30e12eb335173648ee6cb548a703c1272c6ba3c981d8a2def711dc69d99e4d1fb6d056e808ea6c623bdb191fc7364b6486c74b2e2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaCo3mnXoZ643mnXoZ6i6cMJlancMU:A3k03kHRJARJv3k03kHRJARJ+
TLSH
T11B858C03F79900E8D15AC1789AA69A22FB757C560730A7DF136486162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-02_f1579febf01552b32d496f6be6ccd5d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry
- Size 1.8MB
- SHA256 37282739049c30c4a60109b19e9605bb521bb4aba4ea5416236a4bb07f6f6f27
- MD5 f1579febf01552b32d496f6be6ccd5d8
- SHA1 8eaa3925914674027587b325dcced0d0d123eaac
- SHA512 4c2765849bbc1cfa1ef8ebd30e12eb335173648ee6cb548a703c1272c6ba3c981d8a2def711dc69d99e4d1fb6d056e808ea6c623bdb191fc7364b6486c74b2e2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaCo3mnXoZ643mnXoZ6i6cMJlancMU:A3k03kHRJARJv3k03kHRJARJ+
- TLSH
  T11B858C03F79900E8D15AC1789AA69A22FB757C560730A7DF136486162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

aspackv2 discovery persistence spyware stealer adware
- Detects executables packed with ASPack
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2