General
- Target 2026-09-01_721831de6b0904db4f06ee4822afe481_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry
- Size 4.9MB
- Sample260903-lyxw2athld
- SHA256 b86e49a3c2e6c0fb171551805f63beba1f28e32eb517afdea5bc6d9cbc0fa3c8
- MD5 721831de6b0904db4f06ee4822afe481
- SHA1 c26e54f7f694d37bbae9c339b1dd49a5635ceec0
- SHA512 2ec7bdca270075e6226b19a4b69b7a0fa538e220a5585ca2fa8481814097950d1e6497e17502fd790cd54090d8706f7ec87fb10ce354609d16febef0a49c3c61
- SSDEEP 49152:tYRw5x6M1t/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxYOKM:Su5x6M1uWQtZ/K0tGOFWVRuLftC/6dk
- TLSH T158367C13F58500E9D059C178DF6A9232EB62784D07F1B6EF26A09BE12E27AD03F39754
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-01_721831de6b0904db4f06ee4822afe481_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-01_721831de6b0904db4f06ee4822afe481_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-01_721831de6b0904db4f06ee4822afe481_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry
- Size 4.9MB
- SHA256 b86e49a3c2e6c0fb171551805f63beba1f28e32eb517afdea5bc6d9cbc0fa3c8
- MD5 721831de6b0904db4f06ee4822afe481
- SHA1 c26e54f7f694d37bbae9c339b1dd49a5635ceec0
- SHA512 2ec7bdca270075e6226b19a4b69b7a0fa538e220a5585ca2fa8481814097950d1e6497e17502fd790cd54090d8706f7ec87fb10ce354609d16febef0a49c3c61
- SSDEEP 49152:tYRw5x6M1t/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxYOKM:Su5x6M1uWQtZ/K0tGOFWVRuLftC/6dk
- TLSH T158367C13F58500E9D059C178DF6A9232EB62784D07F1B6EF26A09BE12E27AD03F39754
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Sets desktop wallpaper using registry