General
- Target 2026-07-02_546090b5688c757f47ac6d106c7a932a_amadey_cobalt-strike_conti_hijackloader_satacom_vidar_wannacry
- Size 947KB
- Sample260702-sfbpeadx7n
- SHA256 bf07244c5464f9a78639af30b354c019509950e30a40fff45c138f5398b73bf0
- MD5 546090b5688c757f47ac6d106c7a932a
- SHA1 bb61c588186783682fb6c3629bf6cb8bca43fda8
- SHA512 987274b3c114e8dd523e6acee872b6892100ecdb4ccaa42d0f234b17ce5f26a061c5a65a4d5b2258b255ce30ff0ac2661d6aec409c1a09c63958a44d7cc7e946
- SSDEEP 24576:io3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxFq9:z3k03kHRJS
- TLSH T19A25AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-02_546090b5688c757f47ac6d106c7a932a_amadey_cobalt-strike_conti_hijackloader_satacom_vidar_wannacry.exe
Resource
win10v2004-20260513-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-02_546090b5688c757f47ac6d106c7a932a_amadey_cobalt-strike_conti_hijackloader_satacom_vidar_wannacry.exe
Resource
win11ltsc2024-20260629-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-02_546090b5688c757f47ac6d106c7a932a_amadey_cobalt-strike_conti_hijackloader_satacom_vidar_wannacry
- Size 947KB
- SHA256 bf07244c5464f9a78639af30b354c019509950e30a40fff45c138f5398b73bf0
- MD5 546090b5688c757f47ac6d106c7a932a
- SHA1 bb61c588186783682fb6c3629bf6cb8bca43fda8
- SHA512 987274b3c114e8dd523e6acee872b6892100ecdb4ccaa42d0f234b17ce5f26a061c5a65a4d5b2258b255ce30ff0ac2661d6aec409c1a09c63958a44d7cc7e946
- SSDEEP 24576:io3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxFq9:z3k03kHRJS
- TLSH T19A25AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.