wannacry | b5d294d837dc5d4289ade9377106884e44a70039da85ea835d4d8caeba62f88e

General

Target
2026-07-29_25c0c419d5401d73d05d93b211f9c9ac_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 182KB
Sample260730-cey6baxclb
SHA256 b5d294d837dc5d4289ade9377106884e44a70039da85ea835d4d8caeba62f88e
MD5 25c0c419d5401d73d05d93b211f9c9ac
SHA1 a4bcdd91aaf83ea6556b5f9dd04d23176c0cf989
SHA512 f9aaab28ab2056f33a061cda0bcbffb7be0bb8b1e4d88079433e6124fec4f7630726a9d49887332b988ff1f54fa60c68452d0747df2ea1ac6d4d87163cdfd54c
SSDEEP 3072:OOe2ZA/SL8q7btExL8vS4JxvjCzRaEv/u6wa3Z0mz:DZAKLdfq4bjCzRa2vz
TLSH
T1A8047C45B7F500FAE5B7C1398A92154AF672784507209BEF03A04376AF236E0AD3EF65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-29_25c0c419d5401d73d05d93b211f9c9ac_cobalt-strike_icedid_luca-stealer_njrat_stealc
- Size 182KB
- SHA256 b5d294d837dc5d4289ade9377106884e44a70039da85ea835d4d8caeba62f88e
- MD5 25c0c419d5401d73d05d93b211f9c9ac
- SHA1 a4bcdd91aaf83ea6556b5f9dd04d23176c0cf989
- SHA512 f9aaab28ab2056f33a061cda0bcbffb7be0bb8b1e4d88079433e6124fec4f7630726a9d49887332b988ff1f54fa60c68452d0747df2ea1ac6d4d87163cdfd54c
- SSDEEP 3072:OOe2ZA/SL8q7btExL8vS4JxvjCzRaEv/u6wa3Z0mz:DZAKLdfq4bjCzRa2vz
- TLSH
  T1A8047C45B7F500FAE5B7C1398A92154AF672784507209BEF03A04376AF236E0AD3EF65
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery exploit wannacry persistence ransomware spyware stealer worm
- Family: Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Renames multiple (728) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Deletes itself
- Executes dropped EXE
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2