2026-08-01_589a3401bff30aa82b9ae9d13fecf51d_amadey_cobalt-strike_conti_elex_hijackloader_wannacry

General

Target
2026-08-01_589a3401bff30aa82b9ae9d13fecf51d_amadey_cobalt-strike_conti_elex_hijackloader_wannacry
Size 965KB
Sample260801-vc48natvaz
SHA256 471b523bec5f55928e4543b4ef785191fe05d45db2ff11b0a88a9a892f008c66
MD5 589a3401bff30aa82b9ae9d13fecf51d
SHA1 a47c5cc90167112a3e526c7a3b0ed4c714187f37
SHA512 83979f09dea10a27fa2185d93d99105a7bab96f524f066bef19f01dd5c42bb69076b5a510d65cc119a205c03b674b6eacde8d24f2b524471614cd8df77487359
SSDEEP 12288:cPE/F5V5KV5izrqFkbQX6IjUl54G2nC79Q1gL5pRTcAkS/3hzN8qE43fm78V8F:J//IifqFuyDA54GX79l5jcAkSYqyE8F
TLSH
T19C255A16F6608679D073C075C5D2A7B6EA31384547309BDF1389E7382F23BE69A3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_589a3401bff30aa82b9ae9d13fecf51d_amadey_cobalt-strike_conti_elex_hijackloader_wannacry

2026-08-01_589a3401bff30aa82b9ae9d13fecf51d_amadey_cobalt-strike_conti_elex_hijackloader_wannacry

.exe 965KB

IMPHASH b941ddedcc51e5706d41335adb4e6b2a
SHA256 471b523bec5f55928e4543b4ef785191fe05d45db2ff11b0a88a9a892f008c66
MD5 589a3401bff30aa82b9ae9d13fecf51d
SHA1 a47c5cc90167112a3e526c7a3b0ed4c714187f37
SHA512 83979f09dea10a27fa2185d93d99105a7bab96f524f066bef19f01dd5c42bb69076b5a510d65cc119a205c03b674b6eacde8d24f2b524471614cd8df77487359
SSDEEP 12288:cPE/F5V5KV5izrqFkbQX6IjUl54G2nC79Q1gL5pRTcAkS/3hzN8qE43fm78V8F:J//IifqFuyDA54GX79l5jcAkSYqyE8F
TLSH
T19C255A16F6608679D073C075C5D2A7B6EA31384547309BDF1389E7382F23BE69A3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths