2026-07-13_7c5e580a80450461d606a162512a0886_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry

General

Target
2026-07-13_7c5e580a80450461d606a162512a0886_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry
Size 832KB
Sample260713-1x59cabw21
SHA256 d5615adb16c4877b88d097f98b870b94c4520c6a93e73b9b7e0cc12c64473341
MD5 7c5e580a80450461d606a162512a0886
SHA1 a4b5bf8bc7721cd3d72d98406654b6324d3ee0c8
SHA512 080fbbe45b33af7345cf5f9230871bd58a94201c33bb7955a91c3b7c138aeee5c6ffeb5836bf5693915177e2f339612e3ed12447ae1a35ccd1276b3ada52a5f9
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCE:J/sCv7QExqatgl8beJTTx0yFybaBCE
TLSH
T11B055B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F32BF0B73A769
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-13_7c5e580a80450461d606a162512a0886_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry

2026-07-13_7c5e580a80450461d606a162512a0886_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry

.exe 832KB

IMPHASH b941ddedcc51e5706d41335adb4e6b2a
SHA256 d5615adb16c4877b88d097f98b870b94c4520c6a93e73b9b7e0cc12c64473341
MD5 7c5e580a80450461d606a162512a0886
SHA1 a4b5bf8bc7721cd3d72d98406654b6324d3ee0c8
SHA512 080fbbe45b33af7345cf5f9230871bd58a94201c33bb7955a91c3b7c138aeee5c6ffeb5836bf5693915177e2f339612e3ed12447ae1a35ccd1276b3ada52a5f9
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCE:J/sCv7QExqatgl8beJTTx0yFybaBCE
TLSH
T11B055B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F32BF0B73A769
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths