2026-07-30_4c016e7ace2114abd153103588318fe1_amadey_cobalt-strike_elex_wannacry

General

Target
2026-07-30_4c016e7ace2114abd153103588318fe1_amadey_cobalt-strike_elex_wannacry
Size 5.1MB
Sample260730-hrlnmsdd94
SHA256 c8fc2cd2a322992b38235df01484e31e99679c0db9034873701ffdcc6ad55dd6
MD5 4c016e7ace2114abd153103588318fe1
SHA1 799e71668bfda251cd3d50fc216b12debbb33cf5
SHA512 7d0abbd947c65a2d8649673f69dc80e03f70e940ae3a67104ee80ca954d4915bd96c652d0b9d6d32fc8bb431dbcfb1cbf7e8aaff0a785beaec62b4cba537c288
SSDEEP 49152:zLkLgVLKRWTQ6Zs5DhgPoXpvPji0AjrpYqW:NKRuy5a2joX6p
TLSH
T18C367D12F6A44231E0B3A071C5E7A7AAED7635510B308ACB4384977D6F33BD19A39376
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_4c016e7ace2114abd153103588318fe1_amadey_cobalt-strike_elex_wannacry

File Explorer

2026-07-30_4c016e7ace2114abd153103588318fe1_amadey_cobalt-strike_elex_wannacry

.exe 5.1MB

2026-07-30_4c016e7ace2114abd153103588318fe1_amadey_cobalt-strike_elex_wannacry

IMPHASH ba90ad34d445f6ef742e06891b3f8020
SHA256 c8fc2cd2a322992b38235df01484e31e99679c0db9034873701ffdcc6ad55dd6
MD5 4c016e7ace2114abd153103588318fe1
SHA1 799e71668bfda251cd3d50fc216b12debbb33cf5
SHA512 7d0abbd947c65a2d8649673f69dc80e03f70e940ae3a67104ee80ca954d4915bd96c652d0b9d6d32fc8bb431dbcfb1cbf7e8aaff0a785beaec62b4cba537c288
SSDEEP 49152:zLkLgVLKRWTQ6Zs5DhgPoXpvPji0AjrpYqW:NKRuy5a2joX6p
TLSH
T18C367D12F6A44231E0B3A071C5E7A7AAED7635510B308ACB4384977D6F33BD19A39376
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

12796

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

HeapFree HeapAlloc GetProcessHeap GetVersionExW FreeLibrary GetProcAddress LoadLibraryW QueryPerformanceCounter GetCommandLineW GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime GetModuleHandleA TerminateProcess CreateProcessW lstrcmpiW lstrcpynW CopyFileW FormatMessageW GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW CreateDirectoryW OutputDebugStringW lstrcmpW CompareStringW GetSystemDefaultLangID GetLastError GetCurrentProcess GetTickCount GetStartupInfoA

user32

LoadKeyboardLayoutW UnloadKeyboardLayout

advapi32

RegCreateKeyExW RegQueryValueExW RegSetValueExW RegOpenKeyExW RegEnumValueW RegCloseKey

imm32

ImmInstallIMEW

ole32

CoInitialize CoUninitialize

shlwapi

SHDeleteKeyW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

msvcrt

exit _vsnwprintf memmove wcsstr _c_exit _except_handler3 _XcptFilter _cexit _exit _acmdln __getmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _controlfp

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_4c016e7ace2114abd153103588318fe1_amadey_cobalt-strike_elex_wannacry

kernel32

user32

advapi32

imm32

ole32

shlwapi

version

msvcrt

generic