General
- Target 2026-07-03_b0ccd2c0a03fa646bbe5ad4c655656cb_amadey_cobalt-strike_conti_hijackloader_satacom_vidar_wannacry
- Size 960KB
- Sample260703-c46lpafs6r
- SHA256 68d7c908b4ef86b343c86a5714afb361108606af4437dfa52443d538b0f01d59
- MD5 b0ccd2c0a03fa646bbe5ad4c655656cb
- SHA1 4458e2828f8213e9700210e8a7fc25c399d3e7df
- SHA512 643202360e6c3f20671c7459e15e7bdba75f9afe91175cfc98aaa1f7fd4edcba9cfcf8e8107e9b9f68b71b1b29cc3c76ec9e60b08be38504e10423998f78319e
- SSDEEP 24576:a43mnXoZ6i6cMJliLKhSaagqOai45EWLaozD5TvinrmC:x3kHRJw56rX
- TLSH T197258C03A6980FE5E11F817495A24666EB777C125F6087CF1364AE153F327C0AE3A3A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-03_b0ccd2c0a03fa646bbe5ad4c655656cb_amadey_cobalt-strike_conti_hijackloader_satacom_vidar_wannacry.exe
Resource
win10v2004-20260513-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-03_b0ccd2c0a03fa646bbe5ad4c655656cb_amadey_cobalt-strike_conti_hijackloader_satacom_vidar_wannacry.exe
Resource
win11ltsc2024-20260629-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-03_b0ccd2c0a03fa646bbe5ad4c655656cb_amadey_cobalt-strike_conti_hijackloader_satacom_vidar_wannacry
- Size 960KB
- SHA256 68d7c908b4ef86b343c86a5714afb361108606af4437dfa52443d538b0f01d59
- MD5 b0ccd2c0a03fa646bbe5ad4c655656cb
- SHA1 4458e2828f8213e9700210e8a7fc25c399d3e7df
- SHA512 643202360e6c3f20671c7459e15e7bdba75f9afe91175cfc98aaa1f7fd4edcba9cfcf8e8107e9b9f68b71b1b29cc3c76ec9e60b08be38504e10423998f78319e
- SSDEEP 24576:a43mnXoZ6i6cMJliLKhSaagqOai45EWLaozD5TvinrmC:x3kHRJw56rX
- TLSH T197258C03A6980FE5E11F817495A24666EB777C125F6087CF1364AE153F327C0AE3A3A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.