2026-09-01_0615955b24cb509e0a3e961ffdd32699_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-01_0615955b24cb509e0a3e961ffdd32699_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry
Size 3.7MB
Sample260903-vfzscacl21
SHA256 dff3cd7d366c7861f2811f70ddb48d49935a5720b0f10debb316c87412ee05c5
MD5 0615955b24cb509e0a3e961ffdd32699
SHA1 49582cbdccc30dc388105ded9877d81e74515697
SHA512 7794693db9042067f12008666cbbeec1bbd932b80ea444bbc17d54866c8892a1bdcfc54be26687d10b09db5b3a6949060dabe25ebba0d6722d28a4f2759eb375
SSDEEP 98304:NoMl8D1jmb2zxA/BoMl8D1jmb2zxA/BoMl8D1jmb2zxA/H:NoMl8D1jv1A/BoMl8D1jv1A/BoMl8D16
TLSH
T1DB068D23F25540B6D07241B0829AA63FD334BD65033195DB97C0DE29BFA7AD2993A733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-01_0615955b24cb509e0a3e961ffdd32699_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry

File Explorer

2026-09-01_0615955b24cb509e0a3e961ffdd32699_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry

.exe 3.7MB

2026-09-01_0615955b24cb509e0a3e961ffdd32699_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry

IMPHASH 02a9c3810ff5453d372b495c1db94607
SHA256 dff3cd7d366c7861f2811f70ddb48d49935a5720b0f10debb316c87412ee05c5
MD5 0615955b24cb509e0a3e961ffdd32699
SHA1 49582cbdccc30dc388105ded9877d81e74515697
SHA512 7794693db9042067f12008666cbbeec1bbd932b80ea444bbc17d54866c8892a1bdcfc54be26687d10b09db5b3a6949060dabe25ebba0d6722d28a4f2759eb375
SSDEEP 98304:NoMl8D1jmb2zxA/BoMl8D1jmb2zxA/BoMl8D1jmb2zxA/H:NoMl8D1jv1A/BoMl8D1jv1A/BoMl8D16
TLSH
T1DB068D23F25540B6D07241B0829AA63FD334BD65033195DB97C0DE29BFA7AD2993A733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4640

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_DEBUG_STRIPPED

PDB paths

iphlpapi

GetNetworkParams

ws2_32

WSAEventSelect WSAGetLastError WSAStartup accept bind closesocket connect gethostbyname htonl htons inet_addr ioctlsocket listen recv send socket

advapi32

RegCloseKey RegCreateKeyA RegOpenKeyExA RegQueryValueExA RegSetValueExA

kernel32

AddAtomA CloseHandle CopyFileA CreateEventA CreateFileA CreateFileMappingA CreateMutexA CreateThread ExitProcess FileTimeToLocalFileTime FileTimeToSystemTime FindAtomA FindClose FindFirstFileA FindNextFileA FreeLibrary GetAtomNameA GetCommandLineA GetCurrentThreadId GetDriveTypeA GetFileSize GetLastError GetLocalTime GetModuleFileNameA GetModuleHandleA GetProcAddress GetStartupInfoA GetSystemDirectoryA GetSystemTime GetSystemTimeAsFileTime GetTempFileNameA GetTempPathA GetTickCount GetTimeZoneInformation GetVersionExA GetWindowsDirectoryA GlobalAlloc GlobalFree InterlockedIncrement LoadLibraryA MapViewOfFile OpenProcess ReadFile ReleaseMutex ResetEvent SetFilePointer SetLastError SetUnhandledExceptionFilter Sleep SystemTimeToFileTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile WaitForSingleObject WinExec WriteFile lstrcatA lstrcmpA lstrcpyA lstrcpynA lstrlenA

msvcrt

_fdopen _fileno _fstat _isatty _strdup _write __getmainargs __mb_cur_max __p__environ __p__fmode __set_app_type _assert _cexit _ctype _errno _iob _isctype _onexit _pctype _setmode _strnicmp _vsnprintf abort atexit atoi fclose fflush fgetc fopen fprintf fread free fscanf fseek ftell fwrite getc getenv isdigit islower localeconv malloc memchr memcpy memmove memset puts rand realloc rewind setlocale setvbuf signal sprintf srand strcat strchr strcmp strcoll strcpy strftime strlen strncpy strstr strtod strtol strtoul strxfrm toupper ungetc

shell32

ShellExecuteA

user32

CharLowerA CloseWindow FindWindowA MessageBoxA wsprintfA

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-01_0615955b24cb509e0a3e961ffdd32699_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry

iphlpapi

ws2_32

advapi32

kernel32

msvcrt

shell32

user32

generic