General
- Target 2026-09-29_ecfc07fb2578995356b9e162f660914b_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry
- Size 3.1MB
- Sample260929-rkt6wasake
- SHA256 afe9405cede3585beb27b4419d047f176bff9f1ed7c18f5c438be12dd67ee269
- MD5 ecfc07fb2578995356b9e162f660914b
- SHA1 dcb4a769c52866331144e9c31ed2a7f88ff25ed1
- SHA512 63c5c19211e45e3f17b07aef146415bb7d4c066604410ff25a6e18a5392f9a04d1f5d98215688d3491afede93bd6bd7df375dabb6b9193ac9bc2e822de71a26d
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatgltY5Sv:TID41qW1PszVZX5Q
- TLSH T1D6E59D42B7D54963E1771232487752A21E72B9210F34E28F2398766D9F337C0AB377A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_ecfc07fb2578995356b9e162f660914b_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
Resource
win10v2004-20260911-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-29_ecfc07fb2578995356b9e162f660914b_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-29_ecfc07fb2578995356b9e162f660914b_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry
- Size 3.1MB
- SHA256 afe9405cede3585beb27b4419d047f176bff9f1ed7c18f5c438be12dd67ee269
- MD5 ecfc07fb2578995356b9e162f660914b
- SHA1 dcb4a769c52866331144e9c31ed2a7f88ff25ed1
- SHA512 63c5c19211e45e3f17b07aef146415bb7d4c066604410ff25a6e18a5392f9a04d1f5d98215688d3491afede93bd6bd7df375dabb6b9193ac9bc2e822de71a26d
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatgltY5Sv:TID41qW1PszVZX5Q
- TLSH T1D6E59D42B7D54963E1771232487752A21E72B9210F34E28F2398766D9F337C0AB377A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory