2026-08-01_6619a67f5f4f4815444e81de518b9057_amadey_cobalt-strike_elex_hijackloader_wannacry

General

Target
2026-08-01_6619a67f5f4f4815444e81de518b9057_amadey_cobalt-strike_elex_hijackloader_wannacry
Size 1.5MB
Sample260802-axbfvsba57
SHA256 29c454377b6e4f48e7eaf97d89828fed9210c516c7f72a0b648fdeb368d4576f
MD5 6619a67f5f4f4815444e81de518b9057
SHA1 0c3463300cab4e17e2bf8283907db189e7849f49
SHA512 49f090b1b2df453379b94270f1ad6072b4bddd4e43fedb33e2ff1aa8833588ecd5b798967815bae127c35f3df8c4054fcc2363404e0e5c5d786ae1918ba3e12a
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lK+gPZe0p4Ek4niOkl/A04szE87JKTvm:WqFgqFUHieW4SkZP4sz9Mb
TLSH
T15C753A16F6B88336D0B3C0B5C5D6A7B6FA32344557308ADB0349D3282E27BD5963A739
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_6619a67f5f4f4815444e81de518b9057_amadey_cobalt-strike_elex_hijackloader_wannacry

2026-08-01_6619a67f5f4f4815444e81de518b9057_amadey_cobalt-strike_elex_hijackloader_wannacry

.exe 1.5MB

IMPHASH b941ddedcc51e5706d41335adb4e6b2a
SHA256 29c454377b6e4f48e7eaf97d89828fed9210c516c7f72a0b648fdeb368d4576f
MD5 6619a67f5f4f4815444e81de518b9057
SHA1 0c3463300cab4e17e2bf8283907db189e7849f49
SHA512 49f090b1b2df453379b94270f1ad6072b4bddd4e43fedb33e2ff1aa8833588ecd5b798967815bae127c35f3df8c4054fcc2363404e0e5c5d786ae1918ba3e12a
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lK+gPZe0p4Ek4niOkl/A04szE87JKTvm:WqFgqFUHieW4SkZP4sz9Mb
TLSH
T15C753A16F6B88336D0B3C0B5C5D6A7B6FA32344557308ADB0349D3282E27BD5963A739
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths