Extracted

Extracted

• • Target
    2026-05-29_92a6cc2d8c76098e6924e9aff8f40276_coinminer_elex_wannacry
  • Size 7.0MB
  • SHA256 9410374bb9ccfb1a8a15aac5a038202e1ce7fb841a5128edf4d348d82db760c3
  • MD5 92a6cc2d8c76098e6924e9aff8f40276
  • SHA1 df96c08b76055b82b5eb3bd5f1af4d1a8a1b816a
  • SHA512 fa8478b9e6e63f7a10b877fe6b1b525648324bfe9d45ca119ae042422d5b976eb97ff4d698d54ae724dc0c532bbb57c9aeff2ea16f7315409ceab92c957b8880
  • SSDEEP 196608:+p2HtMvhbv/HuH4VDnFKaY8Fmv9FIQNu0RQYOjktKc5UrHC:+p2H0OH41Y8IIV0RQiRSri
  • TLSH
    T1467633417754FAB2C821C4B99ECF9BDA423BE73D52600E9BD0D55E48AECB581A3036C6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorcredential_accessdiscoveryhijackloadersnappyclientloaderspywarestealer

  • Detects HijackLoader (aka IDAT Loader)

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Family: SnappyClient

    SnappyClient is a C2 framework with information stealing capabilities, written in C++.

    backdoorstealersnappyclient

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2