Extracted

• • Target
    2026-05-29_e9f8455cf2d2722ed9251b30ba41745c_coinminer_elex_wannacry
  • Size 6.1MB
  • SHA256 f4c5ee0246966ebda3e1152202bab72d4911554b7fe1fd838fa4b1e69b6b2130
  • MD5 e9f8455cf2d2722ed9251b30ba41745c
  • SHA1 197b663cb92183483fe8023322844032e3e53f73
  • SHA512 f38a9f1c94ccff23d76a3637ce4ffc7c7dd91e2adc881bbc8d5ee52615bfcbee1b4798bbb8299016a02d3191344824a05f9afd1590daa7edd5a62edff4f45872
  • SSDEEP 196608:+pavVHeJDtGwNzFOsC4iZ1bPCJ4oN7nDRs8rtxJ:+peE4KzgfzbKJ4g7nDW8rR
  • TLSH
    T14D563395BF8040F1C7A284B44E5ED7621676F7DA93209F479AE90F603E93283E7471CA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydeerstealerhijackloaderloaderstealer

  • Detects DeerStealer

    stealer

  • Detects HijackLoader (aka IDAT Loader)

  • Family: DeerStealer

    DeerStealer is a sophisticated information stealer written in C++.

    stealerdeerstealer

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2