2026-07-08_8c5dd1fa37d9d7f0f42499907f9d7f2c_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-08_8c5dd1fa37d9d7f0f42499907f9d7f2c_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry
Size 188KB
Sample260708-y261bsht2v
SHA256 2da87d7fa0d7164920807abd953e912001082987f05a91a19697a19cd68a5637
MD5 8c5dd1fa37d9d7f0f42499907f9d7f2c
SHA1 26aea9900bf4528333f3ca459707e2a488a05c18
SHA512 6b4992fc343de1dd5c0a6aa2ef1fa7204a37a401d714a12c277bae9b64bacefdc8ae8445e2bd669ba444691141d8436f44920a7970b7c4f96c16a885afd3aab4
SSDEEP 3072:qoAHnOWYJmofr1oLNVbEY6fxxomCP1NV6UIsxbVvwljx/aNVHdVvwljxZVMAFRxk:kHnVq5K4lVC9PhzIba7fIvnu
TLSH
T1C5148E13CEA408D2FA564630B4E5064ADEB5BE57AB91C7DF632882141F71380BB693FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-08_8c5dd1fa37d9d7f0f42499907f9d7f2c_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry

File Explorer

2026-07-08_8c5dd1fa37d9d7f0f42499907f9d7f2c_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry

.exe 188KB

2026-07-08_8c5dd1fa37d9d7f0f42499907f9d7f2c_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry

IMPHASH 1e2f1157724358595d4ba5f4d5e8d784
SHA256 2da87d7fa0d7164920807abd953e912001082987f05a91a19697a19cd68a5637
MD5 8c5dd1fa37d9d7f0f42499907f9d7f2c
SHA1 26aea9900bf4528333f3ca459707e2a488a05c18
SHA512 6b4992fc343de1dd5c0a6aa2ef1fa7204a37a401d714a12c277bae9b64bacefdc8ae8445e2bd669ba444691141d8436f44920a7970b7c4f96c16a885afd3aab4
SSDEEP 3072:qoAHnOWYJmofr1oLNVbEY6fxxomCP1NV6UIsxbVvwljx/aNVHdVvwljxZVMAFRxk:kHnVq5K4lVC9PhzIba7fIvnu
TLSH
T1C5148E13CEA408D2FA564630B4E5064ADEB5BE57AB91C7DF632882141F71380BB693FD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12820

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\jenkins\workspace\8-2-build-windows-amd64-cygwin\jdk8u321\2141\build\windows-amd64\jdk\objs\jabswitch\jabswitch.pdb

advapi32

RegOpenKeyExW RegQueryValueExW RegSetValueExW RegCloseKey

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

user32

wsprintfW

kernel32

GetProcAddress FreeLibrary VirtualQuery GetProcessHeap HeapFree HeapAlloc GetCurrentProcessId ProcessIdToSessionId GetVersionExW GetModuleFileNameW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent RaiseException MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetModuleHandleW GetLastError

vcruntime140

_CxxThrowException __std_exception_destroy __vcrt_GetModuleFileNameW __vcrt_LoadLibraryExW memset strstr wcsstr __C_specific_handler __C_specific_handler_noexcept __std_exception_copy

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf __stdio_common_vsprintf_s _set_fmode __p__commode fputs fgets fclose fopen_s __acrt_iob_func feof

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _initialize_onexit_table perror terminate _crt_atexit _errno exit _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type __p___argv _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e _exit _c_exit __p___argc _cexit

api-ms-win-crt-filesystem-l1-1-0

rename remove

api-ms-win-crt-string-l1-1-0

strcat_s strtok_s _stricmp strcpy_s _wcslwr_s wcscpy_s wcslen wcstok_s wcscat_s

api-ms-win-crt-heap-l1-1-0

_set_new_mode free _callnewh malloc

api-ms-win-crt-environment-l1-1-0

_dupenv_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-08_8c5dd1fa37d9d7f0f42499907f9d7f2c_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry

advapi32

version

user32

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic