General
- Target 2026-08-12_d2d91777fd907973306f0cfb34a867f2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry
- Size 944KB
- Sample260812-p3eg2axcpf
- SHA256 1fc90da35bfc65c08c68ed7e2335e2064d62652fbfe4fe921f58b3b90d8b51ac
- MD5 d2d91777fd907973306f0cfb34a867f2
- SHA1 1b491205606c8e35ced0db53b23ed567491b897e
- SHA512 697f45094d6e6ec242c6695f4b2346697831c54f9aa24d09c8561c931b1138eae102ef8507f0785e262da96e24b254bd4b0e51d1d26ca09b4b0c92d0da034be3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuaoFoEFif:A3k03kHRJKG
- TLSH T185259E03E79500F8D11AC1749AA65A22FB75BC62173097DF2368C6152F63BD0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-12_d2d91777fd907973306f0cfb34a867f2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-12_d2d91777fd907973306f0cfb34a867f2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-12_d2d91777fd907973306f0cfb34a867f2_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry
- Size 944KB
- SHA256 1fc90da35bfc65c08c68ed7e2335e2064d62652fbfe4fe921f58b3b90d8b51ac
- MD5 d2d91777fd907973306f0cfb34a867f2
- SHA1 1b491205606c8e35ced0db53b23ed567491b897e
- SHA512 697f45094d6e6ec242c6695f4b2346697831c54f9aa24d09c8561c931b1138eae102ef8507f0785e262da96e24b254bd4b0e51d1d26ca09b4b0c92d0da034be3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuaoFoEFif:A3k03kHRJKG
- TLSH T185259E03E79500F8D11AC1749AA65A22FB75BC62173097DF2368C6152F63BD0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory