Extracted

• • Target
    2026-08-15_c86c67841d8d560fcba7ba5b8e93154f_elex_wannacry
  • Size 8.9MB
  • SHA256 e1db6604753180efe43302b5591772a759fafe0505700651bff8332c5fe0016e
  • MD5 c86c67841d8d560fcba7ba5b8e93154f
  • SHA1 2c7510d91d2b27aba3b6b00722e8715b4e4383b5
  • SHA512 34da44695e40a7f4f2f999fdc94f096da8949a292a47a2da0b1e385e8b9bcfbb3238601babd4280e311d8c31379d8bf647e5c69977a322ee51d9ef504952e91c
  • SSDEEP 196608:+pvxNhXbrDRvJrg/VDWZRqL0CcTWWRb6S+wULS+NeODnh:+pv7hXjrZRi0C0WWRTwS2eOh
  • TLSH
    T1799633E3B740E5F9E8A94D31CF4FDB124272C32132539B9B87D86E6A1EA25A102570CD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryhijackloaderloaderspywarestealer

  • Detects HijackLoader (aka IDAT Loader)

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2