Extracted

• • Target
    2026-08-22_7cdd492f8bf92e342c2671c79baf274d_elex_wannacry
  • Size 10.0MB
  • SHA256 3924cc20aef6c2864187f4d5f942056b1f2ac33ab66af6e0ce0985701a3ea091
  • MD5 7cdd492f8bf92e342c2671c79baf274d
  • SHA1 afcd955f27c3d919c33ce6e9bd76e03ef69f6d18
  • SHA512 989c3ca3b8e526ad421dca5beb5b244867167a0b616e3326245f3a164ea7b7e9aff34ef6a0cb622dbace5755a146781bcec7157886fba6449fa195652bb3e0d4
  • SSDEEP 196608:+p7qxlODKcTIEGlQq3khEnh9l+0qlpQg9SkLKAIvTahm8u:+p7qrODKFEMQ/kh9l+0qIg4kWPvWhNu
  • TLSH
    T125B63303B71CA8F1E969C8B23F07C3112D77E7DB91465E4B419E0E6A1CA71AA1247DCE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryhijackloaderloader

  • Detects HijackLoader (aka IDAT Loader)

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Detects Windows executables referencing non-Windows User-Agents

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2