2026-07-22_676499b2c3c64983332fde2beeb06d99_amadey_cobalt-strike_elex_hijackloader_wannacry

General

Target
2026-07-22_676499b2c3c64983332fde2beeb06d99_amadey_cobalt-strike_elex_hijackloader_wannacry
Size 2.3MB
Sample260722-v932vsab47
SHA256 822f5ad60a58a58e94db560da6b3aca9c30c1a42d286e77b288d96f9cb467077
MD5 676499b2c3c64983332fde2beeb06d99
SHA1 4f5cedda76b21ce393ef64f30aa37cdd84894a9c
SHA512 e74bd460e5016b2188d5c9354a5952e0fcf5c9e7eb5deb9af4f8de67015ac0a8009148b76fe33d1b90895dafd21519b37ad0b4c61b258b0b57989685b15ea35d
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaRaov5jcAkSYqyE3YTqMi8CtBd2QHCHmTBl:cuytJJ8y5iTtpYqOqJtb2IRpYq
TLSH
T193B53A25F6A48631D073C179C5D2A79AEE7234424B308ACB1385D76C2F277E6D93A732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_676499b2c3c64983332fde2beeb06d99_amadey_cobalt-strike_elex_hijackloader_wannacry

2026-07-22_676499b2c3c64983332fde2beeb06d99_amadey_cobalt-strike_elex_hijackloader_wannacry

.exe 2.3MB

IMPHASH b941ddedcc51e5706d41335adb4e6b2a
SHA256 822f5ad60a58a58e94db560da6b3aca9c30c1a42d286e77b288d96f9cb467077
MD5 676499b2c3c64983332fde2beeb06d99
SHA1 4f5cedda76b21ce393ef64f30aa37cdd84894a9c
SHA512 e74bd460e5016b2188d5c9354a5952e0fcf5c9e7eb5deb9af4f8de67015ac0a8009148b76fe33d1b90895dafd21519b37ad0b4c61b258b0b57989685b15ea35d
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaRaov5jcAkSYqyE3YTqMi8CtBd2QHCHmTBl:cuytJJ8y5iTtpYqOqJtb2IRpYq
TLSH
T193B53A25F6A48631D073C179C5D2A79AEE7234424B308ACB1385D76C2F277E6D93A732
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths