Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    2026-04-11_aaa13c6df24b1d33addefa594abcd16e_elex_wannacry
  • Size 6.5MB
  • SHA256 f8b15b607c9ca94f8b8e9cc242a154994640391b4db137292693b07614ef7a0f
  • MD5 aaa13c6df24b1d33addefa594abcd16e
  • SHA1 88240be8488c2339b8ea6affe40f44155f95de55
  • SHA512 c42f4ac8afae4c6c724c77ef9b19e716520ccc3892d512b99abba8ed113466d029737fba0b1fe64d1b43061507c6abb176a4790ace798bad2ab62090d156e8dd
  • SSDEEP 196608:xzLUCgPCST+B4yPMTYvs7RVtDMahvTgLu6VuQ+:xvdgPVCBgTYvs7eahTMu5
  • TLSH
    T100663314BFA9D5F7DD8756770E8C37B3B5BC8B8804B91987331892490E5C890A12FDBA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2backdoorjamesfuckdefense_evasiondiscoverydropperexecutionfabookiegcleanernullmixeronlyloggerredlinesectopratsmokeloadersocelarsinfostealerinstallerloaderpersistenceratspywarestealerthemidatrojan

  • Detect Fabookie payload

  • Fabookie

    Fabookie is facebook account info stealer.

    spywarestealerfabookie

  • Fabookie family

    fabookie

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Gcleaner family

    gcleaner

  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

    droppernullmixer

  • Nullmixer family

    nullmixer

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • Onlylogger family

    onlylogger

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Smokeloader family

    smokeloader

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars

  • Socelars family

    socelars

  • Socelars payload

  • Custom signature

    Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

  • Custom signature

    Detects executables Discord URL observed in first stage droppers

  • Custom signature

    Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Custom signature

    Detects executables packed with ASPack

  • Custom signature

    Detects executables packed with Themida

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • OnlyLogger payload

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops Chrome extension

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2