2026-07-30_c5b6581d3d9f1a0bfe097f73affeebd3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry

General

Target
2026-07-30_c5b6581d3d9f1a0bfe097f73affeebd3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry
Size 2.1MB
Sample260730-dfapsaxhpc
SHA256 07b32c70c42adffa3ee2a314de9611a87635f4899bf3cf553366d4b856df1a8d
MD5 c5b6581d3d9f1a0bfe097f73affeebd3
SHA1 b262214088e32a8a6b677f4cb5caf7725c0cc911
SHA512 5a6ff13d750eb2d98ddab0ddd7a5a64409ef0cc84b02aa8ea723629fe695f10c8d4c8646d5d8a3fb92924acab80f3f7a35f12cee702b8068709f1376196a34f8
SSDEEP 24576:J/sCv7rTiw24DtD+qBAaadYTqMi8CtBd2QHCHmTBW5JakI5jcAkSYqyE:N7iw2G+cqJtb2IXpYq
TLSH
T1D8A53926F6A88621D07BD074C6E2965AFA3378450BB086CB12D9D73C1F337E19979723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_c5b6581d3d9f1a0bfe097f73affeebd3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry

2026-07-30_c5b6581d3d9f1a0bfe097f73affeebd3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry

.exe 2.1MB

IMPHASH b941ddedcc51e5706d41335adb4e6b2a
SHA256 07b32c70c42adffa3ee2a314de9611a87635f4899bf3cf553366d4b856df1a8d
MD5 c5b6581d3d9f1a0bfe097f73affeebd3
SHA1 b262214088e32a8a6b677f4cb5caf7725c0cc911
SHA512 5a6ff13d750eb2d98ddab0ddd7a5a64409ef0cc84b02aa8ea723629fe695f10c8d4c8646d5d8a3fb92924acab80f3f7a35f12cee702b8068709f1376196a34f8
SSDEEP 24576:J/sCv7rTiw24DtD+qBAaadYTqMi8CtBd2QHCHmTBW5JakI5jcAkSYqyE:N7iw2G+cqJtb2IXpYq
TLSH
T1D8A53926F6A88621D07BD074C6E2965AFA3378450BB086CB12D9D73C1F337E19979723
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths