2026-10-22_b2a4c79e31fc3a959705599a96c28bf3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_b2a4c79e31fc3a959705599a96c28bf3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry
Size 336KB
Sample261024-acc4ysv19j
SHA256 1ee460be2a729239ead18b0fab20978c4e55b6b6acad2e6fbb323c8cda124753
MD5 b2a4c79e31fc3a959705599a96c28bf3
SHA1 955e2643cfd6e4b3c979cb83d20d7faea62494cd
SHA512 f1c39635eed3839cdb0563efcaaf5abc4e8af71ba92917f602aab5318ff8f75b3455b3abc27e1397a0ec96c5bf9dce47010e0ba63c077cff7ac6a7fb410c83e6
SSDEEP 6144:R8Xc/xWAKeaSNAroAxzSwuaa723psmeI+sQFqT3Qi:R8XcJlaSNAroANjahXsf3z
TLSH
T1A2745965C68401EAC5AE5134C7E65A0AB73B7D2143E09ACB52C4F63E1F313D0AEF6297
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_b2a4c79e31fc3a959705599a96c28bf3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry

File Explorer

2026-10-22_b2a4c79e31fc3a959705599a96c28bf3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry

.exe 336KB

2026-10-22_b2a4c79e31fc3a959705599a96c28bf3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry

IMPHASH f2250bb9271c5e1d1d06b5a9b18d665f
SHA256 1ee460be2a729239ead18b0fab20978c4e55b6b6acad2e6fbb323c8cda124753
MD5 b2a4c79e31fc3a959705599a96c28bf3
SHA1 955e2643cfd6e4b3c979cb83d20d7faea62494cd
SHA512 f1c39635eed3839cdb0563efcaaf5abc4e8af71ba92917f602aab5318ff8f75b3455b3abc27e1397a0ec96c5bf9dce47010e0ba63c077cff7ac6a7fb410c83e6
SSDEEP 6144:R8Xc/xWAKeaSNAroAxzSwuaa723psmeI+sQFqT3Qi:R8XcJlaSNAroANjahXsf3z
TLSH
T1A2745965C68401EAC5AE5134C7E65A0AB73B7D2143E09ACB52C4F63E1F313D0AEF6297
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4161

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u421\1068\build\windows-i586\jdk\objs\unpackexe\unpack200.pdb

kernel32

UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW

vcruntime140

memcpy memset memchr memcmp strchr strrchr __std_type_info_destroy_list __current_exception __current_exception_context _except_handler4_common

api-ms-win-crt-heap-l1-1-0

realloc _set_new_mode free malloc

api-ms-win-crt-stdio-l1-1-0

fclose __stdio_common_vsprintf __p__commode fwrite __acrt_iob_func _set_fmode fopen fread __stdio_common_vfprintf _fileno fflush

api-ms-win-crt-filesystem-l1-1-0

_mkdir remove

api-ms-win-crt-runtime-l1-1-0

exit terminate _controlfp_s _crt_at_quick_exit _crt_atexit _execute_onexit_table _register_onexit_function abort _initialize_onexit_table _seh_filter_dll _errno _seh_filter_exe _set_app_type _c_exit _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _register_thread_local_exe_atexit_callback _exit _initterm_e __p___argc __p___argv _cexit

api-ms-win-crt-string-l1-1-0

_strdup strncmp strlen strncat strcat strcmp strcpy strtok

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

112KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

41KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

270B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_b2a4c79e31fc3a959705599a96c28bf3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry

kernel32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic