2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry

General

Target
2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry
Size 4.0MB
Sample260730-eblrxsbc78
SHA256 657aeb6f79dea10eb543da0ea8dbeb23ca9fde3b18b77971605047bd5b4b2756
MD5 2e2cb39a6ef3419d9d4b7162e7977bdb
SHA1 bbcfaf7902f4faef6c5c01a7b5b63458804939e3
SHA512 c45eae963c8aa172ef569dad2a418715bc8affb445feefd31e7305a2b7e75a15e86a00a4b253548ccd2d6503f8e520d01bb0026c43d8e2c8d31c7f0d24ed126b
SSDEEP 49152:NOwqFpYqe1lkWu0yLeW4SkZP4sz9Mb5eW4SkZP4sz9MbBPji0Aj:N+6D1lkNLfkZcNfkZcRjo
TLSH
T1D9163B16F6F88723E0B3D1B9C9E2AA49FD3234461B3085CF1259976C2E27BD18536736
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry

2026-07-30_2e2cb39a6ef3419d9d4b7162e7977bdb_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry

.exe 4.0MB

IMPHASH b941ddedcc51e5706d41335adb4e6b2a
SHA256 657aeb6f79dea10eb543da0ea8dbeb23ca9fde3b18b77971605047bd5b4b2756
MD5 2e2cb39a6ef3419d9d4b7162e7977bdb
SHA1 bbcfaf7902f4faef6c5c01a7b5b63458804939e3
SHA512 c45eae963c8aa172ef569dad2a418715bc8affb445feefd31e7305a2b7e75a15e86a00a4b253548ccd2d6503f8e520d01bb0026c43d8e2c8d31c7f0d24ed126b
SSDEEP 49152:NOwqFpYqe1lkWu0yLeW4SkZP4sz9Mb5eW4SkZP4sz9MbBPji0Aj:N+6D1lkNLfkZcNfkZcRjo
TLSH
T1D9163B16F6F88723E0B3D1B9C9E2AA49FD3234461B3085CF1259976C2E27BD18536736
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths