Extracted

• • Target
    2026-08-17_836a798ffa7162e543efd4c253d07630_elex_wannacry
  • Size 10.0MB
  • SHA256 e818c91bc7f4bb7df9288a44ba500060777933cdb096ff6897764579d07bc50b
  • MD5 836a798ffa7162e543efd4c253d07630
  • SHA1 c56f27dc79f9ef8f9bf590de5948b825e8ea2dc1
  • SHA512 4ae0de717fe60da30c0f53e03be7e04ab014e747ea1364fd81163d4dc38df9a9863b39f77a72ddefcd1dfdb9ae6f8084694b985f32f47c16ce681daf1ceaea13
  • SSDEEP 196608:+pkaZzVb6MF0b6xL1704zu4cHlJzfG3nu2nTfVP/sYE5VmCa1n/HuUmLtWWmFpZb:+p/ZZ704zuPvV2nj9cRat/O7upZ
  • TLSH
    T1D4B633803798D8E1D518C9B2AF09E72A91B2F70915014C17FA965C2A0CF77F6B35BBD8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryhijackloaderloader

  • Detects HijackLoader (aka IDAT Loader)

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2