2026-09-24_8ea34e70abd7a158a18c263e838e5265_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-24_8ea34e70abd7a158a18c263e838e5265_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry
Size 3.5MB
Sample260925-fl3c4azejf
SHA256 5c178f4fadcbd66542b0bcf1162f787831b38557a80c8d54faa866b2e5a15261
MD5 8ea34e70abd7a158a18c263e838e5265
SHA1 8e6b25e9d61c53a07b63eef4607c860dfa7294f2
SHA512 d47ae79be690f8036895b787202331350f7a2b48e8baa3b63ed2f6d98bfe3aa68527df7192f0f89256dc1b1cdb26530c943ebf40884d22273c1461e724c2b1bb
SSDEEP 49152:BrGH56rptqJtb2Ij56rJPji0Aj6y6i1zuajsauZjaR:lr3JrpjoGtk
TLSH
T164F59207ADAC4A60D06FBC348D91D7D9A5323C514F216ACB1EC0BE6DBA726D0B53D722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-24_8ea34e70abd7a158a18c263e838e5265_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry

File Explorer

2026-09-24_8ea34e70abd7a158a18c263e838e5265_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry

.exe 3.5MB

2026-09-24_8ea34e70abd7a158a18c263e838e5265_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry

IMPHASH 06e816abddd99267744f1332ea3a8abe
SHA256 5c178f4fadcbd66542b0bcf1162f787831b38557a80c8d54faa866b2e5a15261
MD5 8ea34e70abd7a158a18c263e838e5265
SHA1 8e6b25e9d61c53a07b63eef4607c860dfa7294f2
SHA512 d47ae79be690f8036895b787202331350f7a2b48e8baa3b63ed2f6d98bfe3aa68527df7192f0f89256dc1b1cdb26530c943ebf40884d22273c1461e724c2b1bb
SSDEEP 49152:BrGH56rptqJtb2Ij56rJPji0Aj6y6i1zuajsauZjaR:lr3JrpjoGtk
TLSH
T164F59207ADAC4A60D06FBC348D91D7D9A5323C514F216ACB1EC0BE6DBA726D0B53D722
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

202096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\T\M\Acrobat\Installers\ADNotificationManager\Viewer Release_x64\ADNotificationManager.pdb

urlmon

URLDownloadToFileW

kernel32

GetTickCount64 Process32NextW K32GetModuleBaseNameW DeleteFileW Process32FirstW CloseHandle K32EnumProcesses GetWindowsDirectoryW GetProcAddress LocalFree SystemTimeToFileTime CreateProcessW GetModuleHandleW lstrcpyW K32EnumProcessModules CreateToolhelp32Snapshot InterlockedPushEntrySList RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW OpenProcess K32GetProcessImageFileNameW CreateFileW GetEnvironmentVariableW K32GetModuleFileNameExW GetLongPathNameW GetModuleFileNameW GetPackageFamilyName GetCurrentProcess GetProcessHeap DeleteCriticalSection HeapAlloc GetLastError Sleep InitializeCriticalSectionEx GetCommandLineW HeapFree OutputDebugStringW GetSystemTime IsDebuggerPresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead FreeLibrary LoadLibraryW FormatMessageW

user32

TranslateMessage DispatchMessageW RegisterClassExW CreateWindowExW DefWindowProcW GetMessageW FindWindowW GetLastInputInfo SendMessageW SystemParametersInfoW CharUpperBuffW GetSystemMetrics GetDesktopWindow

advapi32

CryptAcquireContextW RegOpenKeyA RegCreateKeyExW SetNamedSecurityInfoW GetNamedSecurityInfoW CryptCreateHash CryptHashData RegSetValueExW CryptDestroyHash OpenProcessToken RegOpenKeyExW ConvertSidToStringSidW RegDeleteValueW CryptGetHashParam CryptReleaseContext GetTokenInformation RegSetKeyValueW RegDeleteKeyW RegDeleteKeyValueW RegCloseKey RegCreateKeyW RegQueryValueExW

shell32

ShellExecuteW CommandLineToArgvW ShellExecuteExW SHChangeNotify

ole32

CoCreateInstance CoCreateFreeThreadedMarshaler CoInitializeEx CoAllowSetForegroundWindow CoRegisterClassObject CLSIDFromString

oleaut32

SysAllocString SysFreeString SetErrorInfo SysStringLen GetErrorInfo

msvcp140

?tolower@?$ctype@_W@std@@QEBA_W_W@Z ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?_Throw_Cpp_error@std@@YAXH@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z _Cnd_do_broadcast_at_thread_exit _Thrd_id _Thrd_join ?_Xbad_function_call@std@@YAXXZ _Wcscoll ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xbad_alloc@std@@YAXXZ ?id@?$ctype@_W@std@@2V0locale@2@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$collate@_W@std@@2V0locale@2@A _Mtx_destroy_in_situ _Wcsxfrm _Mtx_lock _Mtx_init_in_situ _Mtx_unlock ?c_str@?$_Yarn@D@std@@QEBAPEBDXZ ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ??Bid@locale@std@@QEAA_KXZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy __std_exception_copy _purecall _CxxThrowException __C_specific_handler __current_exception_context __current_exception memset memmove strchr wcsstr memcmp memcpy

api-ms-win-crt-runtime-l1-1-0

_initterm_e _exit _c_exit _register_thread_local_exe_atexit_callback _set_app_type _initterm exit abort _cexit _crt_atexit _get_narrow_winmain_command_line _configure_narrow_argv _seh_filter_exe _beginthreadex _initialize_narrow_environment _invalid_parameter_noinfo terminate _errno _register_onexit_function _initialize_onexit_table _invalid_parameter_noinfo_noreturn

api-ms-win-crt-convert-l1-1-0

wcstol _itow_s

api-ms-win-crt-string-l1-1-0

_wcslwr_s iswspace _wcsicmp wcsncpy_s wcscpy_s wcscat_s strncpy_s

api-ms-win-crt-heap-l1-1-0

free realloc _set_new_mode _callnewh malloc

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode __stdio_common_vswprintf

api-ms-win-crt-math-l1-1-0

ceilf __setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-24_8ea34e70abd7a158a18c263e838e5265_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry

urlmon

kernel32

user32

advapi32

shell32

ole32

oleaut32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic