Extracted

• • Target
    2026-06-04_a15936e82d2196017a200637cb03d7e9_coinminer_elex_wannacry
  • Size 4.7MB
  • SHA256 33530db378e5fa72e536e56f0531ccf6880616d38e0644584d59836639d2fcf9
  • MD5 a15936e82d2196017a200637cb03d7e9
  • SHA1 d59b2f2bbfd88d37097d5057d86d9428a4afec58
  • SHA512 ee1911e748d135d8b17f56993aa9105997c14f362d2c1c574fbfbf47c9b10ad8e10d4e9bcac2c51b2a973ddb2f14a0031975a603197e45f87288217bc0a1e3e1
  • SSDEEP 98304:+pv4559iIVwneKY1Wyhw0FcOd9sTPa9ZYCGtydo9FFHsDeQA9wMTWmk:+pq4I+vyWyesSza9ZYCzhVAeMY
  • TLSH
    T1E536335277C4A8B8C9A8C231DF1EFB349673C7DEA3642E46CB551D622EC316122835F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryhijackloaderloaderspywarestealer

  • Detects HijackLoader (aka IDAT Loader)

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2