General
- Target 2026-08-03_31e4ca3da2d8c59b3278763d10536510_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry
- Size 1.1MB
- Sample260803-ldmwbsfp7t
- SHA256 0fbfd07e8218da2f0665907e1f792df73e5a7fecfa26b58e84c9b08525c1dbfc
- MD5 31e4ca3da2d8c59b3278763d10536510
- SHA1 58415966d785668d60b3131a9639c072bea3f338
- SHA512 d6507e640ff0a9d3f398b2ef41c19ea9a2dd4a54e9c39d74959a0feca0a5f27da4d61927820e891d0805115e82beabaecea50257d8ae94988d6fcb3a7e0e18ea
- SSDEEP 24576:A3mnXoZjzyaEFo7Czy54zycicjTaEMD5TvinrmC:A3kMIv456rX
- TLSH T1A3456C07A6941FE9D12F813499A24A52E7737C225F2087DF13645E263F327D0AE3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-03_31e4ca3da2d8c59b3278763d10536510_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_31e4ca3da2d8c59b3278763d10536510_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-03_31e4ca3da2d8c59b3278763d10536510_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry
- Size 1.1MB
- SHA256 0fbfd07e8218da2f0665907e1f792df73e5a7fecfa26b58e84c9b08525c1dbfc
- MD5 31e4ca3da2d8c59b3278763d10536510
- SHA1 58415966d785668d60b3131a9639c072bea3f338
- SHA512 d6507e640ff0a9d3f398b2ef41c19ea9a2dd4a54e9c39d74959a0feca0a5f27da4d61927820e891d0805115e82beabaecea50257d8ae94988d6fcb3a7e0e18ea
- SSDEEP 24576:A3mnXoZjzyaEFo7Czy54zycicjTaEMD5TvinrmC:A3kMIv456rX
- TLSH T1A3456C07A6941FE9D12F813499A24A52E7737C225F2087DF13645E263F327D0AE3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory