General
- Target 2026-07-09_076eea1b67c945f0b587bb919073d34d_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry
- Size 280KB
- Sample260709-m6dnssas9x
- SHA256 02f8219668aca3f1fec38e34ec9a3d34093a33d43911bff4de72f0ae37c01fa3
- MD5 076eea1b67c945f0b587bb919073d34d
- SHA1 6874fef4a702fcbecd3a70c7f14b61b733db8fd3
- SHA512 ce69fbb63c884123f132185596e2803fa81b1539438f6242949b3cd9db1852c03c07877e1f018524e9f0dc74fd0ef70c8beac6a4283d2bf2c26f41a8567c4dd1
- SSDEEP 6144:kHnVq5K4lVC9dn4EmuSiox6oEc9vTQVC9W8T4N:kHVECpx4Vb97/vsN
- TLSH T14E548E138EA408D2FA168670F9E50656DEB5BD57ABA1C3CF632881040F71380BB697FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-09_076eea1b67c945f0b587bb919073d34d_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
Resource
win10v2004-20260513-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_076eea1b67c945f0b587bb919073d34d_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
Resource
win11ltsc2024-20260706-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-09_076eea1b67c945f0b587bb919073d34d_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry
- Size 280KB
- SHA256 02f8219668aca3f1fec38e34ec9a3d34093a33d43911bff4de72f0ae37c01fa3
- MD5 076eea1b67c945f0b587bb919073d34d
- SHA1 6874fef4a702fcbecd3a70c7f14b61b733db8fd3
- SHA512 ce69fbb63c884123f132185596e2803fa81b1539438f6242949b3cd9db1852c03c07877e1f018524e9f0dc74fd0ef70c8beac6a4283d2bf2c26f41a8567c4dd1
- SSDEEP 6144:kHnVq5K4lVC9dn4EmuSiox6oEc9vTQVC9W8T4N:kHVECpx4Vb97/vsN
- TLSH T14E548E138EA408D2FA168670F9E50656DEB5BD57ABA1C3CF632881040F71380BB697FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.