General
- Target 2026-08-16_83d264e9602819d9ef5fd2c5110f97c4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry
- Size 2.0MB
- Sample260816-v467bstvds
- SHA256 9320ac3947dc9b4b97636832678f2239807195e275709549f365f3f5c5dad657
- MD5 83d264e9602819d9ef5fd2c5110f97c4
- SHA1 d374bbdfecc6cf58a3499fd7cade0c4813b00d05
- SHA512 76f3e292fe3e2c09e86fa531629b27c7d63466176c3e4c033a85e248d734f407cd9e1b556593a6f2b92c0b6fb6d2384f93b4985b200c90bc95a026908a2b8611
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8Jyasc6GVD5TvinrmgHZe0p4Ek4niOkl/b:A3k03kHRJ356rheW4SkZP4sz9Mb
- TLSH T192A53A16F5B84B62D0ABC075C9D66A56FA323C451F308BDB0345BB283E377D19A39326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-16_83d264e9602819d9ef5fd2c5110f97c4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-16_83d264e9602819d9ef5fd2c5110f97c4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-16_83d264e9602819d9ef5fd2c5110f97c4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry
- Size 2.0MB
- SHA256 9320ac3947dc9b4b97636832678f2239807195e275709549f365f3f5c5dad657
- MD5 83d264e9602819d9ef5fd2c5110f97c4
- SHA1 d374bbdfecc6cf58a3499fd7cade0c4813b00d05
- SHA512 76f3e292fe3e2c09e86fa531629b27c7d63466176c3e4c033a85e248d734f407cd9e1b556593a6f2b92c0b6fb6d2384f93b4985b200c90bc95a026908a2b8611
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8Jyasc6GVD5TvinrmgHZe0p4Ek4niOkl/b:A3k03kHRJ356rheW4SkZP4sz9Mb
- TLSH T192A53A16F5B84B62D0ABC075C9D66A56FA323C451F308BDB0345BB283E377D19A39326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory