General
- Target 2026-09-29_2fca85a71339e275a0faec285f59daa5_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry
- Size 3.9MB
- Sample260930-d4cjaaterb
- SHA256 9f3b226adab47474657c944fed1e6c7c644be11f44ef8b738e3e8ccc87b35caa
- MD5 2fca85a71339e275a0faec285f59daa5
- SHA1 c406c470da82f0d08a7b83df7af5587cd25774d9
- SHA512 d3079ea3c362a109ca3aa2c04290acf954b0e5a19592ca153af0137cd8ccdf52df27fbb90b9819bdfe563ea3fbfa34db387a104ca2ee7ebc6464c3470633e3ce
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglpy6i1zuajsaw:TID41qW1PszVZ4tk4
- TLSH T1EB168D42B7D548A2E1771232897752921F72B8211F35E2CF2398567D6F337C0AB36B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_2fca85a71339e275a0faec285f59daa5_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
Resource
win10v2004-20260911-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-29_2fca85a71339e275a0faec285f59daa5_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-29_2fca85a71339e275a0faec285f59daa5_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry
- Size 3.9MB
- SHA256 9f3b226adab47474657c944fed1e6c7c644be11f44ef8b738e3e8ccc87b35caa
- MD5 2fca85a71339e275a0faec285f59daa5
- SHA1 c406c470da82f0d08a7b83df7af5587cd25774d9
- SHA512 d3079ea3c362a109ca3aa2c04290acf954b0e5a19592ca153af0137cd8ccdf52df27fbb90b9819bdfe563ea3fbfa34db387a104ca2ee7ebc6464c3470633e3ce
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatgl9wq6qatglpy6i1zuajsaw:TID41qW1PszVZ4tk4
- TLSH T1EB168D42B7D548A2E1771232897752921F72B8211F35E2CF2398567D6F337C0AB36B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory