General
- Target 2026-07-10_14989c7efd622e924b37cdce885c273c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry
- Size 2.0MB
- Sample260710-w151jaey5l
- SHA256 21b7b92fc789958d35a931d9b42b2b6fbb77b383e985548563ee136807623803
- MD5 14989c7efd622e924b37cdce885c273c
- SHA1 d5a48aee923a2ef0a05535cbed16f5e50395cf12
- SHA512 ef1e38f7948695c7e71daa2b1e494b27f0e1dba72991432e0228fd74a6eb414c3b4e7d3f88d80509ccb134e9a2c6548cc6ceb73f786a98f68b264670c339037e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GoXGBOlLi5D5TvinrmbMD5TvinrmbMD53:A3k03kHRJC56rX56rX56rapYq
- TLSH T112A54A16A6A84FA5D06FC174C5D24666EA733C465F2087CF1354AE293F337D0AA3A363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-07-10_14989c7efd622e924b37cdce885c273c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_14989c7efd622e924b37cdce885c273c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-10_14989c7efd622e924b37cdce885c273c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry
- Size 2.0MB
- SHA256 21b7b92fc789958d35a931d9b42b2b6fbb77b383e985548563ee136807623803
- MD5 14989c7efd622e924b37cdce885c273c
- SHA1 d5a48aee923a2ef0a05535cbed16f5e50395cf12
- SHA512 ef1e38f7948695c7e71daa2b1e494b27f0e1dba72991432e0228fd74a6eb414c3b4e7d3f88d80509ccb134e9a2c6548cc6ceb73f786a98f68b264670c339037e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GoXGBOlLi5D5TvinrmbMD5TvinrmbMD53:A3k03kHRJC56rX56rX56rapYq
- TLSH T112A54A16A6A84FA5D06FC174C5D24666EA733C465F2087CF1354AE293F337D0AA3A363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory