shodi | 2026-11-09_fc2a7e9aa2478972cb00f26b1ef59324_cobalt-strike_elex_nymaim_rhadamanthys_stop_vidar_wannacry

General

Target
2026-11-09_fc2a7e9aa2478972cb00f26b1ef59324_cobalt-strike_elex_nymaim_rhadamanthys_stop_vidar_wannacry
Size 2.6MB
Sample261109-ryzzaacz2n
SHA256 623049f7a5a9a74137f908e40252e4ffb603077019497a2f39657a1488d4ae2a
MD5 fc2a7e9aa2478972cb00f26b1ef59324
SHA1 3053d15ab5ccf41b92c20d3879ecd2279fe9a709
SHA512 04d43058cb3a0e8dfd02016138eaca56663250c5f54d24732920922eb6fe3151818d1f5b843b94d8df4498ad2ee64118d7a24564cfe2d555858a01dcab82f4f6
SSDEEP 24576:qwesT7lGTwesT7lG/wesT7lG/wesT7lG/wesT7lG/wesT7lG7wesT7lGSrU7:qwDTWwDT6wDT6wDT6wDT6wDTuwDTFrw
TLSH
T1BAC51817BE808032D4A10D300665EB9EA77A7924C9034E9777947EDEFFF1AD18E28275
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

worm shodi

Detects Shodi worm 1 IoCs

resource	yara_rule
sample	family_shodi

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-09_fc2a7e9aa2478972cb00f26b1ef59324_cobalt-strike_elex_nymaim_rhadamanthys_stop_vidar_wannacry

2026-11-09_fc2a7e9aa2478972cb00f26b1ef59324_cobalt-strike_elex_nymaim_rhadamanthys_stop_vidar_wannacry

.exe 2.6MB

IMPHASH 77f13bc24efea5a05601b43cf44d1f1a
SHA256 623049f7a5a9a74137f908e40252e4ffb603077019497a2f39657a1488d4ae2a
MD5 fc2a7e9aa2478972cb00f26b1ef59324
SHA1 3053d15ab5ccf41b92c20d3879ecd2279fe9a709
SHA512 04d43058cb3a0e8dfd02016138eaca56663250c5f54d24732920922eb6fe3151818d1f5b843b94d8df4498ad2ee64118d7a24564cfe2d555858a01dcab82f4f6
SSDEEP 24576:qwesT7lGTwesT7lG/wesT7lG/wesT7lG/wesT7lG/wesT7lG7wesT7lGSrU7:qwDTWwDT6wDT6wDT6wDT6wDTuwDTFrw
TLSH
T1BAC51817BE808032D4A10D300665EB9EA77A7924C9034E9777947EDEFFF1AD18E28275
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

15703

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths