2026-07-20_8a212202a2ad5344a59f371bafd266a3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry

General

Target
2026-07-20_8a212202a2ad5344a59f371bafd266a3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry
Size 961KB
Sample260720-nmnv4aay21
SHA256 5a3ad69385537c421ee6d6ce071abb9c4de5d03e86d0f86da3b041e0a6204067
MD5 8a212202a2ad5344a59f371bafd266a3
SHA1 c0e3c2cb9420b6dfb4dfe507586e593e8f6530e0
SHA512 ce600b198b9df7aec25f66c0b919dc66b3be3c8d5ddc406d7199f9bf8d53f1f59d26fd0e2e95af386754861869c297a4e7d3c224705377d9a928b86a41960107
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAaaGaF:J/sCv7rTiw24DtD+qBAaaGaF
TLSH
T12B254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_8a212202a2ad5344a59f371bafd266a3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry

2026-07-20_8a212202a2ad5344a59f371bafd266a3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry

.exe 961KB

IMPHASH b941ddedcc51e5706d41335adb4e6b2a
SHA256 5a3ad69385537c421ee6d6ce071abb9c4de5d03e86d0f86da3b041e0a6204067
MD5 8a212202a2ad5344a59f371bafd266a3
SHA1 c0e3c2cb9420b6dfb4dfe507586e593e8f6530e0
SHA512 ce600b198b9df7aec25f66c0b919dc66b3be3c8d5ddc406d7199f9bf8d53f1f59d26fd0e2e95af386754861869c297a4e7d3c224705377d9a928b86a41960107
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAaaGaF:J/sCv7rTiw24DtD+qBAaaGaF
TLSH
T12B254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths