General
- Target wannacry.exe
- Size 46KB
- Sample260818-dtdctsdm4y
- SHA256 b133340e3441d27bd36b828ccc9273224016fb201df33b0687c01fc146365b2c
- MD5 9bd988196aca25841f785355a2d526d1
- SHA1 3332e9709ab2c83239d6b6586a7bfa61e55dd721
- SHA512 2007bede9d013bdcc5ccafe235f8447ad4a4e08ab13cc243fd04ed2d8a6dcf2d9debf608f8ad6e45aae97e26c00c8a636e0e5c2cdf8db7f4b571e5d56dfa933c
- SSDEEP 768:CuuUVTacggH9WUFNRuvmo2qjqFpPklO08APIx1zjbHgX3iR79cf5E1BDZbx:CuuUVTnru2t7kw08lH3bAXShE6bdbx
- TLSH T1A7232B003BE9812FF2BF5F7899F26145467AF1636603D64A1CC452DB4A23FC2DA426F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
wannacry.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
wannacry.exe
Resource
win11ltsc2024-20260709-en
Malware Config
Extracted
-
asyncrat
-
0.5.8
-
Default
-
coolslot.co:6606
-
coolslot.co:7707
-
coolslot.co:8808
-
coolslot.co:80
-
coolslot.co:8080
-
coolslot.co:443
-
coolslot.co:8443
-
789win.crow789slot.co:6606
-
789win.crow789slot.co:7707
-
789win.crow789slot.co:8808
-
789win.crow789slot.co:80
-
789win.crow789slot.co:8080
-
789win.crow789slot.co:443
-
789win.crow789slot.co:8443
-
crow789slot.co:6606
-
crow789slot.co:7707
-
crow789slot.co:8808
-
crow789slot.co:80
-
crow789slot.co:8080
-
crow789slot.co:443
-
crow789slot.co:8443
-
hersearch.co:6606
-
hersearch.co:7707
-
hersearch.co:8808
-
hersearch.co:80
-
hersearch.co:8080
-
hersearch.co:443
-
hersearch.co:8443
-
humshaughparish.org.uk:6606
-
humshaughparish.org.uk:7707
-
humshaughparish.org.uk:8808
-
humshaughparish.org.uk:80
-
humshaughparish.org.uk:8080
-
humshaughparish.org.uk:443
-
humshaughparish.org.uk:8443
-
789win.bingo:6606
-
789win.bingo:7707
-
789win.bingo:8808
-
789win.bingo:80
-
789win.bingo:8080
-
789win.bingo:443
-
789win.bingo:8443
-
dapan.tw:6606
-
dapan.tw:7707
-
dapan.tw:8808
-
dapan.tw:80
-
dapan.tw:8080
-
dapan.tw:443
-
dapan.tw:8443
-
www.thiscuteness.nl:6606
-
www.thiscuteness.nl:7707
-
www.thiscuteness.nl:8808
-
www.thiscuteness.nl:80
-
www.thiscuteness.nl:8080
-
www.thiscuteness.nl:443
-
www.thiscuteness.nl:8443
-
88job.tw:6606
-
88job.tw:7707
-
88job.tw:8808
-
88job.tw:80
-
88job.tw:8080
-
88job.tw:443
-
88job.tw:8443
-
98win.na-helper.ninja:6606
-
98win.na-helper.ninja:7707
-
98win.na-helper.ninja:8808
-
98win.na-helper.ninja:80
-
98win.na-helper.ninja:8080
-
98win.na-helper.ninja:443
-
98win.na-helper.ninja:8443
-
elsuenosoest.nl:6606
-
elsuenosoest.nl:7707
-
elsuenosoest.nl:8808
-
elsuenosoest.nl:80
-
elsuenosoest.nl:8080
-
elsuenosoest.nl:443
-
elsuenosoest.nl:8443
-
cycart.in:6606
-
cycart.in:7707
-
cycart.in:8808
-
cycart.in:80
-
cycart.in:8080
-
cycart.in:443
-
cycart.in:8443
-
horseporn.top:6606
-
horseporn.top:7707
-
horseporn.top:8808
-
horseporn.top:80
-
horseporn.top:8080
-
horseporn.top:443
-
horseporn.top:8443
-
jnvstresults5th.in:6606
-
jnvstresults5th.in:7707
-
jnvstresults5th.in:8808
-
jnvstresults5th.in:80
-
jnvstresults5th.in:8080
-
jnvstresults5th.in:443
-
jnvstresults5th.in:8443
-
abslot.co:6606
-
abslot.co:7707
-
abslot.co:8808
-
abslot.co:80
-
abslot.co:8080
-
abslot.co:443
-
abslot.co:8443
-
areaslotswallet.vip:6606
-
areaslotswallet.vip:7707
-
areaslotswallet.vip:8808
-
areaslotswallet.vip:80
-
areaslotswallet.vip:8080
-
areaslotswallet.vip:443
-
areaslotswallet.vip:8443
-
renewcell.in:6606
-
renewcell.in:7707
-
renewcell.in:8808
-
renewcell.in:80
-
renewcell.in:8080
-
renewcell.in:443
-
renewcell.in:8443
-
aw99slot.co:6606
-
aw99slot.co:7707
-
aw99slot.co:8808
-
aw99slot.co:80
-
aw99slot.co:8080
-
aw99slot.co:443
-
aw99slot.co:8443
-
onlinebonuscasinof.co:6606
-
onlinebonuscasinof.co:7707
-
onlinebonuscasinof.co:8808
-
onlinebonuscasinof.co:80
-
onlinebonuscasinof.co:8080
-
onlinebonuscasinof.co:443
-
onlinebonuscasinof.co:8443
-
batikslot138vip.co:6606
-
batikslot138vip.co:7707
-
batikslot138vip.co:8808
-
batikslot138vip.co:80
-
batikslot138vip.co:8080
-
batikslot138vip.co:443
-
batikslot138vip.co:8443
-
wordgenerator.me:6606
-
wordgenerator.me:7707
-
wordgenerator.me:8808
-
wordgenerator.me:80
-
wordgenerator.me:8080
-
wordgenerator.me:443
-
wordgenerator.me:8443
-
jet88betslot.co:6606
-
jet88betslot.co:7707
-
jet88betslot.co:8808
-
jet88betslot.co:80
-
jet88betslot.co:8080
-
jet88betslot.co:443
-
jet88betslot.co:8443
-
fruitcol.com.co:6606
-
fruitcol.com.co:7707
-
fruitcol.com.co:8808
-
fruitcol.com.co:80
-
fruitcol.com.co:8080
-
fruitcol.com.co:443
-
fruitcol.com.co:8443
-
678bet2.cyou:6606
-
678bet2.cyou:7707
-
678bet2.cyou:8808
-
678bet2.cyou:80
-
678bet2.cyou:8080
-
678bet2.cyou:443
-
678bet2.cyou:8443
-
dachbet632.co:6606
-
dachbet632.co:7707
-
dachbet632.co:8808
-
dachbet632.co:80
-
dachbet632.co:8080
-
dachbet632.co:443
-
dachbet632.co:8443
-
villagesofparkwood.com:6606
-
villagesofparkwood.com:7707
-
villagesofparkwood.com:8808
-
villagesofparkwood.com:80
-
villagesofparkwood.com:8080
-
villagesofparkwood.com:443
-
villagesofparkwood.com:8443
-
zwdwCFrgVL8d
-
delay
3
-
install
true
-
install_file
svchost.exe
-
install_folder
%AppData%
Targets
-
- Target wannacry.exe
- Size 46KB
- SHA256 b133340e3441d27bd36b828ccc9273224016fb201df33b0687c01fc146365b2c
- MD5 9bd988196aca25841f785355a2d526d1
- SHA1 3332e9709ab2c83239d6b6586a7bfa61e55dd721
- SHA512 2007bede9d013bdcc5ccafe235f8447ad4a4e08ab13cc243fd04ed2d8a6dcf2d9debf608f8ad6e45aae97e26c00c8a636e0e5c2cdf8db7f4b571e5d56dfa933c
- SSDEEP 768:CuuUVTacggH9WUFNRuvmo2qjqFpPklO08APIx1zjbHgX3iR79cf5E1BDZbx:CuuUVTnru2t7kw08lH3bAXShE6bdbx
- TLSH T1A7232B003BE9812FF2BF5F7899F26145467AF1636603D64A1CC452DB4A23FC2DA426F9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE