2026-08-21_2329a2a4202f7a89557080acfb8f4d54_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-21_2329a2a4202f7a89557080acfb8f4d54_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry
Size 1.7MB
Sample260821-yl6dvsdb38
SHA256 7ebce16d66b3f3c6707ba3fc8a570ab677f76011bc4df56e4f007a9bf478b743
MD5 2329a2a4202f7a89557080acfb8f4d54
SHA1 2cd1005d5dcc6519f982031f44fbcdfcaab673b4
SHA512 d2933a1322db7f889ece126f54edc0f9cd1342938f0673654963bbd4055ea43cc37bf9a65bf6fb541528da9c3d7359c91257faef931bde42907bb4d4fe1d5070
SSDEEP 24576:wp5yyCjYTqMi8CtBd2QHCHmTBW5bYTqMi8CtBd2QHCHmTBW5w5jcAkSYqyE:4qJtb2IdqJtb2IRpYq
TLSH
T1A6850925F6748731D073C0B9C5D2AA9AEE3234825B308ACB1286D76C2F677D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-21_2329a2a4202f7a89557080acfb8f4d54_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry

File Explorer

2026-08-21_2329a2a4202f7a89557080acfb8f4d54_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry

.exe 1.7MB

2026-08-21_2329a2a4202f7a89557080acfb8f4d54_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry

IMPHASH 70a6871a2d4adec7c9027cfb0ef587f8
SHA256 7ebce16d66b3f3c6707ba3fc8a570ab677f76011bc4df56e4f007a9bf478b743
MD5 2329a2a4202f7a89557080acfb8f4d54
SHA1 2cd1005d5dcc6519f982031f44fbcdfcaab673b4
SHA512 d2933a1322db7f889ece126f54edc0f9cd1342938f0673654963bbd4055ea43cc37bf9a65bf6fb541528da9c3d7359c91257faef931bde42907bb4d4fe1d5070
SSDEEP 24576:wp5yyCjYTqMi8CtBd2QHCHmTBW5bYTqMi8CtBd2QHCHmTBW5w5jcAkSYqyE:4qJtb2IdqJtb2IRpYq
TLSH
T1A6850925F6748731D073C0B9C5D2AA9AEE3234825B308ACB1286D76C2F677D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12656

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\jenkins\workspace\8-2-build-windows-x64-cygwin-sans-NAS\jdk8u381\237\build\windows-x64\jdk\objs\jabswitch\jabswitch.pdb

advapi32

RegOpenKeyExW RegQueryValueExW RegSetValueExW RegCloseKey

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

user32

wsprintfW

kernel32

GetProcAddress FreeLibrary VirtualQuery GetProcessHeap HeapFree HeapAlloc GetCurrentProcessId ProcessIdToSessionId GetVersionExW GetModuleFileNameW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent RaiseException MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetModuleHandleW GetLastError

vcruntime140

__vcrt_LoadLibraryExW memcpy __vcrt_GetModuleFileNameW _CxxThrowException memset strstr wcsstr __C_specific_handler __C_specific_handler_noexcept __current_exception __current_exception_context __std_exception_copy __std_exception_destroy

api-ms-win-crt-stdio-l1-1-0

fopen_s __p__commode feof fgets fputs __acrt_iob_func _set_fmode __stdio_common_vfprintf __stdio_common_vsprintf_s fclose

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _crt_atexit terminate perror exit _register_onexit_function _seh_filter_exe _set_app_type _errno _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e _exit _register_thread_local_exe_atexit_callback __p___argc __p___argv _cexit _c_exit

api-ms-win-crt-filesystem-l1-1-0

rename remove

api-ms-win-crt-string-l1-1-0

wcstok_s wcscpy_s wcslen _wcslwr_s wcscat_s strcpy_s strcat_s strtok_s _stricmp

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh malloc free

api-ms-win-crt-environment-l1-1-0

_dupenv_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-21_2329a2a4202f7a89557080acfb8f4d54_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry

advapi32

version

user32

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic