Extracted

• • Target
    2026-07-01_568c3fbe165163c7f68ace84b2d39269_elex_wannacry
  • Size 11.4MB
  • SHA256 9c8a46b954b8a6dbc29d5cf8aca14da6f5687e412dab1bd07881284edb8f3fe5
  • MD5 568c3fbe165163c7f68ace84b2d39269
  • SHA1 2e0d15abfaf7f12ff47ea98404a70eb511502e2b
  • SHA512 80c418ba6804276d94d6df204472b95f68d68785852ce06d7cb5e9eb4a1d9031fec100273c931b04a84e14f9a3b6bfb8ac9fa05137e891a6a0e60fb4c8ee091f
  • SSDEEP 196608:+p8l7o2ou3wilvdIOpiOkTr1NSWsrvNv3pm8+jk2fSNYpimwgA:+pON3wilvfpidTZNcdMLS/+A
  • TLSH
    T140C633423B191CF0CC64857A9F15D78A6BB2F39636411EC386FC4E796D83AD28A431DE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryhijackloaderloaderspywarestealer

  • Detects HijackLoader (aka IDAT Loader)

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2