9286b65d36ebc7b6a1e4a89ba8489aff8e271ee7521d496cbcb2852648d5e6d7

General

Target
2026-07-09_7b3f837c019728dd77f31e3de582002f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry
Size 1.4MB
Sample260709-vm4pwaes9p
SHA256 9286b65d36ebc7b6a1e4a89ba8489aff8e271ee7521d496cbcb2852648d5e6d7
MD5 7b3f837c019728dd77f31e3de582002f
SHA1 d0c7ff0c3923cb5d754c74c7a7567ed2cf883033
SHA512 d74b7ada492a0394794f7b6c34598bbc14b9b391445502694d678c8afd17cc41c7b68f4f19bf015adf2ab715a8454f78e9fe0fc5d913e38953a0e2551a45dd62
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaca2e0Le5ji0hmxNrM:A3k03kHRJ2Pji0Aj
TLSH
T10E658C17F6A402B5D067C0B9C5D6AA5AFA713842173086CF1398C7283F67BE19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-09_7b3f837c019728dd77f31e3de582002f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry
- Size 1.4MB
- SHA256 9286b65d36ebc7b6a1e4a89ba8489aff8e271ee7521d496cbcb2852648d5e6d7
- MD5 7b3f837c019728dd77f31e3de582002f
- SHA1 d0c7ff0c3923cb5d754c74c7a7567ed2cf883033
- SHA512 d74b7ada492a0394794f7b6c34598bbc14b9b391445502694d678c8afd17cc41c7b68f4f19bf015adf2ab715a8454f78e9fe0fc5d913e38953a0e2551a45dd62
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaca2e0Le5ji0hmxNrM:A3k03kHRJ2Pji0Aj
- TLSH
  T10E658C17F6A402B5D067C0B9C5D6AA5AFA713842173086CF1398C7283F67BE19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

aspackv2 discovery persistence spyware stealer adware
- Detects executables packed with ASPack
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2