2026-08-04_d4ae0f0def219790ce115df63e7a4c5e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry

General

Target
2026-08-04_d4ae0f0def219790ce115df63e7a4c5e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry
Size 757KB
Sample260804-15x8pser41
SHA256 aae2c9acc7b8a831d8d3728da9b57472575e6b5685c0f69f3be19d77144633ba
MD5 d4ae0f0def219790ce115df63e7a4c5e
SHA1 effc4cacc661feab06d0ff207a6938536bbb74d9
SHA512 9fc764fa5402bc8d590a5cb8a547cb72954c6a16169acfb97efc5986a898634c4b3552b714e0196a3655a9cc0d2b7f86f6d1f77506f3d48f450f902b372130fe
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSj2PF:KIifqFu1//IifqFuyDA54GX79lSj2PF
TLSH
T154F49E07F6E244FCD557C13089E69372EA71FC225620AB7F2768E6212F20F906F2A755
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_d4ae0f0def219790ce115df63e7a4c5e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry

2026-08-04_d4ae0f0def219790ce115df63e7a4c5e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry

.exe 757KB

IMPHASH b941ddedcc51e5706d41335adb4e6b2a
SHA256 aae2c9acc7b8a831d8d3728da9b57472575e6b5685c0f69f3be19d77144633ba
MD5 d4ae0f0def219790ce115df63e7a4c5e
SHA1 effc4cacc661feab06d0ff207a6938536bbb74d9
SHA512 9fc764fa5402bc8d590a5cb8a547cb72954c6a16169acfb97efc5986a898634c4b3552b714e0196a3655a9cc0d2b7f86f6d1f77506f3d48f450f902b372130fe
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSj2PF:KIifqFu1//IifqFuyDA54GX79lSj2PF
TLSH
T154F49E07F6E244FCD557C13089E69372EA71FC225620AB7F2768E6212F20F906F2A755
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths