2026-08-11_9811476a436817fc957767426a1165da_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar_wannacry

General

Target
2026-08-11_9811476a436817fc957767426a1165da_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar_wannacry
Size 2.4MB
Sample260811-2eppbaha83
SHA256 65ed027b9e5d684d59b6aff5cca69ca6a8e00c3749815e2857ca2e80ca76a8eb
MD5 9811476a436817fc957767426a1165da
SHA1 aed6650e032a37de9f1efb47c15b41e0479751a6
SHA512 9db14a27a37a70f59611865066f5b0041d409c22d399816050a4a7c06a9b50633e28eadec6c6aba9950944c18045bf845b24529f091ebb7192a6928acd5a9a69
SSDEEP 24576:fHg1flT/pT9+bHNgHg1flT/pT9+rP/oXSaGsLfUB7WUtLpwbtLpwAD5Tvinrmb:/gnThqagnThFrGsLfUdbtL2tLb56r
TLSH
T1D2C54A2FEE548EA1C56B51348566C71DD232BC140F1097CB52A8BE2AED32FF07939726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-11_9811476a436817fc957767426a1165da_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar_wannacry

2026-08-11_9811476a436817fc957767426a1165da_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar_wannacry

.exe 2.4MB

IMPHASH b941ddedcc51e5706d41335adb4e6b2a
SHA256 65ed027b9e5d684d59b6aff5cca69ca6a8e00c3749815e2857ca2e80ca76a8eb
MD5 9811476a436817fc957767426a1165da
SHA1 aed6650e032a37de9f1efb47c15b41e0479751a6
SHA512 9db14a27a37a70f59611865066f5b0041d409c22d399816050a4a7c06a9b50633e28eadec6c6aba9950944c18045bf845b24529f091ebb7192a6928acd5a9a69
SSDEEP 24576:fHg1flT/pT9+bHNgHg1flT/pT9+rP/oXSaGsLfUB7WUtLpwbtLpwAD5Tvinrmb:/gnThqagnThFrGsLfUdbtL2tLb56r
TLSH
T1D2C54A2FEE548EA1C56B51348566C71DD232BC140F1097CB52A8BE2AED32FF07939726
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths