Extracted

• • Target
    2026-08-24_80a7e6650b2a99a360cfeab7c6ba94e7_elex_wannacry
  • Size 11.3MB
  • SHA256 98a688d32a1be064474fe79cd9f2693869923b7ac9b5f80d103f938991a509f0
  • MD5 80a7e6650b2a99a360cfeab7c6ba94e7
  • SHA1 437a758521500c93be12e6c9db466910a394e6d5
  • SHA512 1e63046cbfd390f80f19f7647c524cbbdb4c8c1a1bfe4aabcf98b554b5fca78f55e595992e6d8a85d4a8e5262a8c4baebaef1392c9d1df3fe72232c062d543d3
  • SSDEEP 196608:+peLcKrOBdU0CHETE0SnDHdS6VkuVtsYYwk0MWKVKb54UdLWc5PbhGTWZ:+pxF00hTsDHdS6VkIsJ4Kwb54UJWeD4A
  • TLSH
    T137C63307BFC6B5B1D80A75301F5AD7AE257EE3C6E611686BA6982E072D4B01437234FC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryhijackloaderloaderspywarestealerupx

  • Detects HijackLoader (aka IDAT Loader)

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Detects Windows executables referencing non-Windows User-Agents

  • UPX dump on OEP (original entry point)

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2