02f91826cdf5df9efdbed6a315fdda3767dcb5ab49195355a73176b56601885f

General

Target
2026-07-07_b76509b4cbc3941931070275a6603a28_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry
Size 4.0MB
Sample260707-wctycsa13t
SHA256 02f91826cdf5df9efdbed6a315fdda3767dcb5ab49195355a73176b56601885f
MD5 b76509b4cbc3941931070275a6603a28
SHA1 e3f40dadb1f7d30fd6d2d0530896164c13487310
SHA512 24c3e4e98e9265ce6fd1b35f07c19ea0bf08bbd84c9792bda1c15db1a1ecca32a25975b5984cb8eeb071e03aac6123d6ebe2ce08980b113af49a047f1d7042bd
SSDEEP 49152:A3k03kHRJmeW4SkZP4sz9Mb5eW4SkZP4sz9MbkqJtb2IEeW4SkZP4sz9Mb:A3k03kHRkfkZcNfkZckFfkZc
TLSH
T134160916F6788323D0B3C0B9C5D6AA9AFE3234465B308ACB0249D76C2E277D5D636735
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-07_b76509b4cbc3941931070275a6603a28_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry
- Size 4.0MB
- SHA256 02f91826cdf5df9efdbed6a315fdda3767dcb5ab49195355a73176b56601885f
- MD5 b76509b4cbc3941931070275a6603a28
- SHA1 e3f40dadb1f7d30fd6d2d0530896164c13487310
- SHA512 24c3e4e98e9265ce6fd1b35f07c19ea0bf08bbd84c9792bda1c15db1a1ecca32a25975b5984cb8eeb071e03aac6123d6ebe2ce08980b113af49a047f1d7042bd
- SSDEEP 49152:A3k03kHRJmeW4SkZP4sz9Mb5eW4SkZP4sz9MbkqJtb2IEeW4SkZP4sz9Mb:A3k03kHRkfkZcNfkZckFfkZc
- TLSH
  T134160916F6788323D0B3C0B9C5D6AA9AFE3234465B308ACB0249D76C2E277D5D636735
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

aspackv2 discovery persistence spyware stealer adware
- Detects executables packed with ASPack
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2