2026-07-19_971bee2ba71a19b0809bccd1e4ccf1f1_amadey_cobalt-strike_elex_hijackloader_wannacry

General

Target
2026-07-19_971bee2ba71a19b0809bccd1e4ccf1f1_amadey_cobalt-strike_elex_hijackloader_wannacry
Size 1.4MB
Sample260720-ba7ffsax6l
SHA256 b04158f45b11ad7eafb927261cd6c09bd5a8ea94751345caa28975340ee91888
MD5 971bee2ba71a19b0809bccd1e4ccf1f1
SHA1 6276da49f913fec28f98638eb519829e5a04448f
SHA512 5e2a0da27c24bdd777b761f41a1fbc2225faa6aa7641d58d25b70e4f3a15e32da5bf6dd1bbc9e27fef320a510b567b788555f412a5240f083c0c5687224122bc
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lK+ikIifqFu1//IifqFuyDA54GX79lK+if:WqFgqFUHTqFgqFUHI
TLSH
T12C658D07F6A244FCC557C17089E69372AA71FC215620AB7F2768F6212F30F90AF2A755
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-19_971bee2ba71a19b0809bccd1e4ccf1f1_amadey_cobalt-strike_elex_hijackloader_wannacry

2026-07-19_971bee2ba71a19b0809bccd1e4ccf1f1_amadey_cobalt-strike_elex_hijackloader_wannacry

.exe 1.4MB

IMPHASH b941ddedcc51e5706d41335adb4e6b2a
SHA256 b04158f45b11ad7eafb927261cd6c09bd5a8ea94751345caa28975340ee91888
MD5 971bee2ba71a19b0809bccd1e4ccf1f1
SHA1 6276da49f913fec28f98638eb519829e5a04448f
SHA512 5e2a0da27c24bdd777b761f41a1fbc2225faa6aa7641d58d25b70e4f3a15e32da5bf6dd1bbc9e27fef320a510b567b788555f412a5240f083c0c5687224122bc
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lK+ikIifqFu1//IifqFuyDA54GX79lK+if:WqFgqFUHTqFgqFUHI
TLSH
T12C658D07F6A244FCC557C17089E69372AA71FC215620AB7F2768F6212F30F90AF2A755
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths