General
- Target 2026-08-02_dce7c5cf8ad1ea9fa614dee97a04b092_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry
- Size 1.4MB
- Sample260802-qs3ybabj9s
- SHA256 7eaa98579ccfa511f8f8123cee9a05ce6622bebfeefd4f2bbe750b8501ffc719
- MD5 dce7c5cf8ad1ea9fa614dee97a04b092
- SHA1 2f2e14547f811c4e1ced5577994fcd39e5c9de0f
- SHA512 f19af7967c4b8da095c157e4d57af5f2bd934a748a876dbe45fb1c2b147a978c46abe40a0a935adaeda26ef34437cda55bdb0d82ea180ff7dfe1a5e0f4852bad
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6mEaBCQr5jcAkSYqyE:A3k03kHRJARJopYq
- TLSH T1C7657C17F7A441B5D067C179CAD2AA56EB32384607309BCF1394D7292F23BE19E3A361
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-02_dce7c5cf8ad1ea9fa614dee97a04b092_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_dce7c5cf8ad1ea9fa614dee97a04b092_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-02_dce7c5cf8ad1ea9fa614dee97a04b092_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry
- Size 1.4MB
- SHA256 7eaa98579ccfa511f8f8123cee9a05ce6622bebfeefd4f2bbe750b8501ffc719
- MD5 dce7c5cf8ad1ea9fa614dee97a04b092
- SHA1 2f2e14547f811c4e1ced5577994fcd39e5c9de0f
- SHA512 f19af7967c4b8da095c157e4d57af5f2bd934a748a876dbe45fb1c2b147a978c46abe40a0a935adaeda26ef34437cda55bdb0d82ea180ff7dfe1a5e0f4852bad
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6mEaBCQr5jcAkSYqyE:A3k03kHRJARJopYq
- TLSH T1C7657C17F7A441B5D067C179CAD2AA56EB32384607309BCF1394D7292F23BE19E3A361
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory