Extracted

• • Target
    2026-08-12_c5289d3980fc4e79f999950f5b0f869c_elex_wannacry
  • Size 12.7MB
  • SHA256 9993b81fa94e2a2897179d38c9d0610b2c4d3af7aea4f41cbe31a286050fd9be
  • MD5 c5289d3980fc4e79f999950f5b0f869c
  • SHA1 37e667d7f4d0eec83e28076abbcb9f5916bba86f
  • SHA512 34655363905b7c33d5c75f2f646474720bae5a8ebc0ea2428b0fb238b13ffcd0b33e99bd5314835622ac30dd612e9c4994fc2470110f3039d18ea7f1f5b5cbd0
  • SSDEEP 196608:+pqhFibraNKhwEOoiBA8WaTDfG+XOLbiQZMnxfEwHmMLO1PZitDSlGdnQchLa1cw:+pqTibdwEhNeaZLWQt985S8nQchLU1d
  • TLSH
    T179D633607B849DF1CA25C131CF8B931384FAEAA617612E8F936D0FA36E538544627DF1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryhijackloaderloaderspywarestealerupx

  • Detects HijackLoader (aka IDAT Loader)

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Detects Windows executables referencing non-Windows User-Agents

  • UPX dump on OEP (original entry point)

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2