2026-07-04_5f6768938335df57bc98dfd00809a4f7_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry

General

Target
2026-07-04_5f6768938335df57bc98dfd00809a4f7_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry
Size 770KB
Sample260704-sr4vbscz3l
SHA256 8daaa50ea61993e27ba61a61df7bb0ba58dd564e813996a5f7b1512fdd3bd2a8
MD5 5f6768938335df57bc98dfd00809a4f7
SHA1 4ba3845efcf0758a4dc581126b06dfbbe988e0ae
SHA512 a835c9d5d29b9a32e3b101e481314522f0b7a9fec5e4b6545fee4a42f5f5f3d2968c5609f976afaa135ae47c08d7d86c88b3751abcb7796184fbacb636b9fc9d
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaE:J/sCv7QExqatgl8beJTTx0yFzaE
TLSH
T1F3F45B53BA4485A2D416023044EB4753EB71F81A1F11978F27BCAB6D2E32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-04_5f6768938335df57bc98dfd00809a4f7_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry

2026-07-04_5f6768938335df57bc98dfd00809a4f7_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry

.exe 770KB

IMPHASH b941ddedcc51e5706d41335adb4e6b2a
SHA256 8daaa50ea61993e27ba61a61df7bb0ba58dd564e813996a5f7b1512fdd3bd2a8
MD5 5f6768938335df57bc98dfd00809a4f7
SHA1 4ba3845efcf0758a4dc581126b06dfbbe988e0ae
SHA512 a835c9d5d29b9a32e3b101e481314522f0b7a9fec5e4b6545fee4a42f5f5f3d2968c5609f976afaa135ae47c08d7d86c88b3751abcb7796184fbacb636b9fc9d
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaE:J/sCv7QExqatgl8beJTTx0yFzaE
TLSH
T1F3F45B53BA4485A2D416023044EB4753EB71F81A1F11978F27BCAB6D2E32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths