General
- Target 2026-08-05_0f4424236d3c9b39d43a7dba31fec47f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_remcos_vidar_wannacry
- Size 3.2MB
- Sample260805-xy3casdf28
- SHA256 27a0a5ee829a596ef12f733d41142ad13c42509633718b2c796840e147856a82
- MD5 0f4424236d3c9b39d43a7dba31fec47f
- SHA1 f5c108b36cf0a905b9a938fff1736c383eeb85f6
- SHA512 c3e5eb0caed411accccb57e2729e914b23a1bb364e5677964acad9625aa0630f483151b2b3020b21b366ecfc74bbe049eaf6141c9a98d79be854e49ac57a173b
- SSDEEP 49152:IoRg5x6c1reBoRg5x6c1rexDoRg5x6c1reBf:Pe5x6c1/e5x6c1ze5x6c1u
- TLSH T18AF57C02F68140F6DB6D1930866A6736BA37FA050755CBC793D4DE7C2F32280AD7626B
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-05_0f4424236d3c9b39d43a7dba31fec47f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_remcos_vidar_wannacry.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-05_0f4424236d3c9b39d43a7dba31fec47f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_remcos_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-05_0f4424236d3c9b39d43a7dba31fec47f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_remcos_vidar_wannacry
- Size 3.2MB
- SHA256 27a0a5ee829a596ef12f733d41142ad13c42509633718b2c796840e147856a82
- MD5 0f4424236d3c9b39d43a7dba31fec47f
- SHA1 f5c108b36cf0a905b9a938fff1736c383eeb85f6
- SHA512 c3e5eb0caed411accccb57e2729e914b23a1bb364e5677964acad9625aa0630f483151b2b3020b21b366ecfc74bbe049eaf6141c9a98d79be854e49ac57a173b
- SSDEEP 49152:IoRg5x6c1reBoRg5x6c1rexDoRg5x6c1reBf:Pe5x6c1/e5x6c1ze5x6c1u
- TLSH T18AF57C02F68140F6DB6D1930866A6736BA37FA050755CBC793D4DE7C2F32280AD7626B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Sets desktop wallpaper using registry