General
- Target 2026-07-08_49a2805b660fe4d86d6ea206c0b46488_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry
- Size 1.0MB
- Sample260708-zf2n6agy3p
- SHA256 e71f212dc23ba7f8493af67d8f2199d28714b3508abb1f828fc7573a0659e519
- MD5 49a2805b660fe4d86d6ea206c0b46488
- SHA1 b7e7331c855df9160544c5a53c5112b04c12223c
- SHA512 f92f153a5b83cbe2695f5bcda2974821b18f978c803b1c26ca684cf1bf9dc1875cf029795c188736141b6784c2987bb13fa96efb0132c0685ed12b8dd9c28d55
- SSDEEP 24576:r0l98bsccaEOHFYTqMi8CtBd2QHCHmTBW5kD5TvinrmC:kqJtb2Ij56rX
- TLSH T17F351825F5A88F65D07BC075C5D2969AEA733C425F3087CB1249AE283F277D1993A323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-08_49a2805b660fe4d86d6ea206c0b46488_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
Resource
win10v2004-20260513-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_49a2805b660fe4d86d6ea206c0b46488_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
Resource
win11ltsc2024-20260706-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-08_49a2805b660fe4d86d6ea206c0b46488_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry
- Size 1.0MB
- SHA256 e71f212dc23ba7f8493af67d8f2199d28714b3508abb1f828fc7573a0659e519
- MD5 49a2805b660fe4d86d6ea206c0b46488
- SHA1 b7e7331c855df9160544c5a53c5112b04c12223c
- SHA512 f92f153a5b83cbe2695f5bcda2974821b18f978c803b1c26ca684cf1bf9dc1875cf029795c188736141b6784c2987bb13fa96efb0132c0685ed12b8dd9c28d55
- SSDEEP 24576:r0l98bsccaEOHFYTqMi8CtBd2QHCHmTBW5kD5TvinrmC:kqJtb2Ij56rX
- TLSH T17F351825F5A88F65D07BC075C5D2969AEA733C425F3087CB1249AE283F277D1993A323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.