Extracted

• • Target
    2026-06-26_724e173d56572dbc08c36284007f9cd8_elex_wannacry
  • Size 15.6MB
  • SHA256 c8f019b3f20d5392c17faf8e5191436e3e48f7e17253ca80c45a76ea7ed5b528
  • MD5 724e173d56572dbc08c36284007f9cd8
  • SHA1 0ef26e3d93f4c46a918956c07e8022ef1d6cb7a0
  • SHA512 1839651048ebc1dcd54f58eed7aab1f674fd697fadd47bfb429f6c1d7d0b09f4b03d5914870f2a8685c442b3f214d732772ee09aa5d6e62b74b8d1f396214b25
  • SSDEEP 393216:+pwYGNXEANlX2IOcq8amZaoiEzVKeXWtqgvVUg4++:eTsU6lX2aR/i2WL3+
  • TLSH
    T13FF633017F4890B2EA3842FA2E46FB264D73D69629871E7ADE9D4F368DB3503103B5D1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryhijackloaderloadercredential_accessspywarestealer

  • Detects HijackLoader (aka IDAT Loader)

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2