2026-11-12_50aae01b060cf325e969ea42a6d3535a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-12_50aae01b060cf325e969ea42a6d3535a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry
Size 353KB
Sample261113-dpslysfx2j
SHA256 2701e5de0ef479ad9786836acf9fd814f1154a0cb8b1325e9cd6b2ccd2463c2c
MD5 50aae01b060cf325e969ea42a6d3535a
SHA1 e24c508b35f5a00b6203695ed35998d379a42bc8
SHA512 ad3957e3f3cc6f8983ddbe13d1d1f444b54c4e58c6ba7778cf33a9d93ed19a5c438dd842ad8bfc450dce47d2915797957e76a3b4671b2e084f71de30b84b829e
SSDEEP 6144:UL4E8OM3VfjmNwFUjpMF+1jIvs7XJlGWQa7:LE8Z7+HpMF+pIvgJl4a
TLSH
T151745B8EB6D48CF5D02591788D53920AE7BEB8300B2087DF3A9C4A0E0F776F19D7A255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-12_50aae01b060cf325e969ea42a6d3535a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry

File Explorer

2026-11-12_50aae01b060cf325e969ea42a6d3535a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry

.exe 353KB

2026-11-12_50aae01b060cf325e969ea42a6d3535a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry

IMPHASH f616ac71ee88e52ca74081cfcb42c941
SHA256 2701e5de0ef479ad9786836acf9fd814f1154a0cb8b1325e9cd6b2ccd2463c2c
MD5 50aae01b060cf325e969ea42a6d3535a
SHA1 e24c508b35f5a00b6203695ed35998d379a42bc8
SHA512 ad3957e3f3cc6f8983ddbe13d1d1f444b54c4e58c6ba7778cf33a9d93ed19a5c438dd842ad8bfc450dce47d2915797957e76a3b4671b2e084f71de30b84b829e
SSDEEP 6144:UL4E8OM3VfjmNwFUjpMF+1jIvs7XJlGWQa7:LE8Z7+HpMF+pIvgJl4a
TLSH
T151745B8EB6D48CF5D02591788D53920AE7BEB8300B2087DF3A9C4A0E0F776F19D7A255
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

42976

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection VirtualFree VirtualAlloc LocalFree LocalAlloc GetVersion GetCurrentThreadId GetThreadLocale GetStartupInfoA GetModuleFileNameA GetLocaleInfoA GetCommandLineA FreeLibrary ExitProcess WriteFile UnhandledExceptionFilter RtlUnwind RaiseException GetStdHandle TlsSetValue TlsGetValue LocalAlloc GetModuleHandleA WriteProcessMemory WriteFile WinExec VirtualFreeEx VirtualAllocEx TerminateProcess SuspendThread SizeofResource SetThreadContext SetLastError SetFileTime SetFilePointer SetFileAttributesA SetEndOfFile ResumeThread ReadFile OpenProcess MapViewOfFile LockResource LoadResource LoadLibraryA IsBadReadPtr GlobalFree GlobalAlloc GetWindowsDirectoryA GetVersionExA GetThreadContext GetTempPathA GetTempFileNameA GetSystemDirectoryA GetShortPathNameA GetProcAddress GetModuleHandleA GetLocalTime GetLastError GetFileTime GetFileSize GetDriveTypeA GetCurrentProcessId GetCurrentProcess GetComputerNameA GetACP FreeResource FreeLibrary FindResourceA FindNextFileA FindFirstFileA FindClose FileTimeToLocalFileTime FileTimeToDosDateTime ExitProcess DuplicateHandle DeleteFileA CreateThread CreateSemaphoreA CreateProcessA CreateFileMappingA CreateFileA CopyFileA CompareStringA CloseHandle LoadLibraryA GetProcAddress

kernelbase

WideCharToMultiByte MultiByteToWideChar Sleep

user32

GetKeyboardType MessageBoxA CharNextA CreateWindowExA UpdateWindow TranslateMessage SendMessageA RegisterClassA PostThreadMessageA PostMessageA PeekMessageA LoadCursorA GetMessageA FindWindowA DispatchMessageA DefWindowProcA

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey RegSetValueExA RegCreateKeyExA RegCloseKey LookupAccountSidA LookupAccountNameA GetSidSubAuthorityCount GetSidSubAuthority GetSidIdentifierAuthority FreeSid AllocateAndInitializeSid

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen

mpr

WNetOpenEnumA WNetEnumResourceA WNetCloseEnum WNetCancelConnectionA WNetCancelConnection2A WNetAddConnection2A

wsock32

WSACleanup WSAStartup gethostname gethostbyname inet_ntoa

ntdll

LdrGetDllHandle

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-12_50aae01b060cf325e969ea42a6d3535a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry

kernel32

kernelbase

user32

advapi32

oleaut32

mpr

wsock32

ntdll

generic