Extracted

• • Target
    2026-08-21_94ea1fb0b6f3fdeddc75b0b6e2e94768_elex_wannacry
  • Size 10.7MB
  • SHA256 f03fd0534af0105ecdbc54a8629b57d00aa26a96d745067b7c163230660dc43f
  • MD5 94ea1fb0b6f3fdeddc75b0b6e2e94768
  • SHA1 f865b6e775dd0aba732af95566645c6677cbd914
  • SHA512 f377b34210b20f7393c1e4be89435165877efb8e2e18040f8969e01c9b867ddc61de18e52b173248e23e468f34828e859cf196392bb1d0e96994fd618006cb03
  • SSDEEP 196608:+pCbS00XEChKb0ys1/e96psN+wkWRoE6FLZF6FMR8xLCjD+/+CIvTahm8v:+pCCXECobO12kpsN+wjaEiP6FM2x2jFg
  • TLSH
    T1C6B633923BC9B5F1C6384034DF0ED7A24179E6535904DC62A3E9AF96EEC3322612B4DD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryhijackloaderloaderspywarestealer

  • Detects HijackLoader (aka IDAT Loader)

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2