2026-07-09_bf7732babbde1378964cca4c4d374e73_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry

General

Target
2026-07-09_bf7732babbde1378964cca4c4d374e73_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry
Size 888KB
Sample260709-pegx9aaz4s
SHA256 bb9670d470a4b9753e73e9c9db6a985f433b2136d1466b0bbadab0b67d86c923
MD5 bf7732babbde1378964cca4c4d374e73
SHA1 2b727bc9942bca7ce35cb6802d01b34253b6214b
SHA512 7ce6c8c12f224ff9dbb8ae08b23bd10e28c9bb1a9bd9f3ba284a3e8a835f95039e7e6a04e9126efb9040889ac4966c1446f6b8058c5709805a4bff47bdcbc778
SSDEEP 12288:cPE/72wcCvRRqE/72wcCvRR58LUeDuUlI24Y+Cut+YCpu:J/sCv7J/sCv7iUg4Y+CugYCpu
TLSH
T1F6158E1767A440A1D467453049F94613EA31FC2A1B20979F16BCEB691E32BF07E3DB2E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-09_bf7732babbde1378964cca4c4d374e73_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry

2026-07-09_bf7732babbde1378964cca4c4d374e73_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry

.exe 888KB

IMPHASH b941ddedcc51e5706d41335adb4e6b2a
SHA256 bb9670d470a4b9753e73e9c9db6a985f433b2136d1466b0bbadab0b67d86c923
MD5 bf7732babbde1378964cca4c4d374e73
SHA1 2b727bc9942bca7ce35cb6802d01b34253b6214b
SHA512 7ce6c8c12f224ff9dbb8ae08b23bd10e28c9bb1a9bd9f3ba284a3e8a835f95039e7e6a04e9126efb9040889ac4966c1446f6b8058c5709805a4bff47bdcbc778
SSDEEP 12288:cPE/72wcCvRRqE/72wcCvRR58LUeDuUlI24Y+Cut+YCpu:J/sCv7J/sCv7iUg4Y+CugYCpu
TLSH
T1F6158E1767A440A1D467453049F94613EA31FC2A1B20979F16BCEB691E32BF07E3DB2E
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths