Extracted

Extracted

• • Target
    2026-09-01_5e28c1f1ace634919592c81ed966a906_elex_wannacry
  • Size 12.5MB
  • SHA256 394b5a455d188a89f00961e46a585323766c7dfc5e0dcc2f3152e390f478b3c5
  • MD5 5e28c1f1ace634919592c81ed966a906
  • SHA1 878691f0cece60eab3ee1ab3affaddf74c14701b
  • SHA512 08a3e70c4159feba2cdbca539afce55d91b37fca61b9f4ddddd992d699b642a1d28ce743bd548478376c5944588962299ff4197efa6274bef6e76abd12c3277e
  • SSDEEP 393216:+pjVUEZauUFZLBvjn5mrtEWHAfREjvPF4TaZW/rc:e5UoU1D4SCJszw
  • TLSH
    T1E0D63342F7F0ECF9C1A989724F0FEF612173D299D98A5AA2405C4E48ADC7125253F7CA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  623bb8d9c6fdcf8c11a6131cec2eaf19credential_accessdiscoveryhijackloadervidarloaderspywarestealer

  • Detects HijackLoader (aka IDAT Loader)

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Detects Windows executables referencing non-Windows User-Agents

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2