2026-07-13_2ff41e64c4abb40f2c6329bb0b17a41e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry

General

Target
2026-07-13_2ff41e64c4abb40f2c6329bb0b17a41e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry
Size 1.6MB
Sample260714-b129esev4z
SHA256 193fcc06ccb434b26aa891d43739031526738123eaac96f54b235615a02e4bd5
MD5 2ff41e64c4abb40f2c6329bb0b17a41e
SHA1 de4f2449d1a74122aa0617bef4f37f966a877a4f
SHA512 12e2ac88e28e59e5da1813dd7ad84c4d2e1b81a685f5a8a0336136369403d903c14d15a4909b0a8b5ef140a6c15b92bf6b8f927f9c68bfd237e505e4fd0fda0d
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBTZe0p4Ek4niOkl/A04szE87JKTvm:NDqatgl9TKweW4SkZP4sz9Mb
TLSH
T19B752957F6788363D0B28075C4D76B9AFE31744A1B3086CB1259D72C2E237E1A63A739
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-13_2ff41e64c4abb40f2c6329bb0b17a41e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry

2026-07-13_2ff41e64c4abb40f2c6329bb0b17a41e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry

.exe 1.6MB

IMPHASH b941ddedcc51e5706d41335adb4e6b2a
SHA256 193fcc06ccb434b26aa891d43739031526738123eaac96f54b235615a02e4bd5
MD5 2ff41e64c4abb40f2c6329bb0b17a41e
SHA1 de4f2449d1a74122aa0617bef4f37f966a877a4f
SHA512 12e2ac88e28e59e5da1813dd7ad84c4d2e1b81a685f5a8a0336136369403d903c14d15a4909b0a8b5ef140a6c15b92bf6b8f927f9c68bfd237e505e4fd0fda0d
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBTZe0p4Ek4niOkl/A04szE87JKTvm:NDqatgl9TKweW4SkZP4sz9Mb
TLSH
T19B752957F6788363D0B28075C4D76B9AFE31744A1B3086CB1259D72C2E237E1A63A739
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths