2026-07-30_9fcd2adb19dae3c6bd7dab5053435a47_amadey_cobalt-strike_elex_hijackloader_wannacry

General

Target
2026-07-30_9fcd2adb19dae3c6bd7dab5053435a47_amadey_cobalt-strike_elex_hijackloader_wannacry
Size 1.9MB
Sample260730-fs2edadj3x
SHA256 dcc03a325cec88a60629c4fcaf8a65f335a1f888d8b57186f6d0113c488d515e
MD5 9fcd2adb19dae3c6bd7dab5053435a47
SHA1 e5bfd64f6d9ce4b67567779c75599e9ccb8e09c9
SHA512 b2a94031b50d14c34272642d23c43e54c291e8db98e9baea5827ba41d32779206d4850c1938096459c7964efd7892a13d9b9d63728013906f11e47bd9c1237f4
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaRajYTqMi8CtBd2QHCHmTBW5X0Le5ji0hmM:cuytJJ8y5iT9qJtb2IQPji0Aj
TLSH
T17C954A26F6B48331D073C079C5D2A79AEA7274424B308ACB5385976D2E377D6C93A732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_9fcd2adb19dae3c6bd7dab5053435a47_amadey_cobalt-strike_elex_hijackloader_wannacry

2026-07-30_9fcd2adb19dae3c6bd7dab5053435a47_amadey_cobalt-strike_elex_hijackloader_wannacry

.exe 1.9MB

IMPHASH b941ddedcc51e5706d41335adb4e6b2a
SHA256 dcc03a325cec88a60629c4fcaf8a65f335a1f888d8b57186f6d0113c488d515e
MD5 9fcd2adb19dae3c6bd7dab5053435a47
SHA1 e5bfd64f6d9ce4b67567779c75599e9ccb8e09c9
SHA512 b2a94031b50d14c34272642d23c43e54c291e8db98e9baea5827ba41d32779206d4850c1938096459c7964efd7892a13d9b9d63728013906f11e47bd9c1237f4
SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARTmPnaRajYTqMi8CtBd2QHCHmTBW5X0Le5ji0hmM:cuytJJ8y5iT9qJtb2IQPji0Aj
TLSH
T17C954A26F6B48331D073C079C5D2A79AEA7274424B308ACB5385976D2E377D6C93A732
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths