Extracted

• • Target
    2026-06-29_bc9bc9c5a6c9cf5f5ec4b486eaf86486_elex_wannacry
  • Size 13.8MB
  • SHA256 047e25cfeac802365b4d4148d30880598fc48b7d6e4177e6c7cb2f95543bdf78
  • MD5 bc9bc9c5a6c9cf5f5ec4b486eaf86486
  • SHA1 7db1aea58613c8c3020f5ec44ac0010cbf2cc160
  • SHA512 caf8634d717faa9ab36fc97ca717e0510115957cabbba0fb0b8e8236d7e7f707db2a5ca5fcd327f998c63a1121119c0c66c948dce935aa613e3b51fde7600dca
  • SSDEEP 393216:+pJ0WkZrNSWZA8R3J5ErNUc6H0hTna85Lr4YfXn:e2WkZrNE85JWY0pa8x9n
  • TLSH
    T1B5E63306F39DA8BAD2B088714F4DDB7510B7EB289945DE0B55A12F6A8EC70B327031DD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryhijackloaderloaderspywarestealeradwarepersistence

  • Detects HijackLoader (aka IDAT Loader)

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2