2026-07-28_94bf48356db0504fe58118d68c753b0f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry

General

Target
2026-07-28_94bf48356db0504fe58118d68c753b0f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry
Size 1.8MB
Sample260729-a3s8vsdb72
SHA256 8188cb82059b9d19d49ac253620ceb4bb13eeffd90f7470639b7004f1a16055a
MD5 94bf48356db0504fe58118d68c753b0f
SHA1 8f222e2f45f0392de6a052f352cf4f369d4706ee
SHA512 838bc46ec0b1794f5515bf718ea405b53d83728c35de3693553f1861076dcfefc5ea2c7eb021293676648232a1a4639c39ec118a28f00efef76d9f8777334df4
SSDEEP 24576:J/sCv7rTiw24DtD+qBAaBCc6Ze0p4Ek4niOkl/A04szE87JKTvm:N7iw2G+DeW4SkZP4sz9Mb
TLSH
T1CC853B16B6BC8723E0B3D075C4E6AB5AF93274451B3086CF1259C72C1E27BE1A939739
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-28_94bf48356db0504fe58118d68c753b0f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry

2026-07-28_94bf48356db0504fe58118d68c753b0f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry

.exe 1.8MB

IMPHASH b941ddedcc51e5706d41335adb4e6b2a
SHA256 8188cb82059b9d19d49ac253620ceb4bb13eeffd90f7470639b7004f1a16055a
MD5 94bf48356db0504fe58118d68c753b0f
SHA1 8f222e2f45f0392de6a052f352cf4f369d4706ee
SHA512 838bc46ec0b1794f5515bf718ea405b53d83728c35de3693553f1861076dcfefc5ea2c7eb021293676648232a1a4639c39ec118a28f00efef76d9f8777334df4
SSDEEP 24576:J/sCv7rTiw24DtD+qBAaBCc6Ze0p4Ek4niOkl/A04szE87JKTvm:N7iw2G+DeW4SkZP4sz9Mb
TLSH
T1CC853B16B6BC8723E0B3D075C4E6AB5AF93274451B3086CF1259C72C1E27BE1A939739
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths