Extracted

• • Target
    2026-06-02_178a4114893b169bfac54252d3213cd0_elex_wannacry
  • Size 11.5MB
  • SHA256 1c0a50ad25e7b6882fef7195c4105f4aeb111cd1159cd942112858fec8bd4ef0
  • MD5 178a4114893b169bfac54252d3213cd0
  • SHA1 9d250bdecc11dd211060044ee432aa928fb56193
  • SHA512 6e4cb627525411233e43220a990a7a903bc8b721fd83b8b8865b6ba35d6d2dc649d60fa736396051c6cef09a8edf1cb06c938e6bb681e89ea23a528bf185ed03
  • SSDEEP 196608:+ptJjyguZmX0C3xxfBN4p2gXUQLiQFe7/tNJE12nNxs42GQ2eUnCeF6mr9jXbOXN:+ptJj5uqL3xZBNgZLiQFebtNJKM/2rPD
  • TLSH
    T1A8C63352B394A4B0E130D2F1BF29C722677AD74929A54E0F038F5D4A3EC3592B357AD8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryhijackloaderloaderspywarestealer

  • Detects HijackLoader (aka IDAT Loader)

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2