Extracted

Extracted

• • Target
    2026-09-01_2e77891af9e7a72fb59ca4e74a00b670_elex_wannacry
  • Size 12.7MB
  • SHA256 eb24fcf88b060573af06bcc5facd2d08894966b625cf42e0fa15da22a5acdaa2
  • MD5 2e77891af9e7a72fb59ca4e74a00b670
  • SHA1 9bec74e34ca092c16b9c4c2b4c5ab754a85c05dd
  • SHA512 433de304d8a3842abe335ea88e6d38f4c52a719ec9015abbe9b127b276812bbe64886ce2aa30017c6266c947d32e4f1a5867c688b93c9e712ef62e0f405e1e88
  • SSDEEP 196608:+ps3WdBhkJqoYux2yjaMd9UvDAoMK6ZG+rUZcQj4rOd5OFYKg5RipuDjcY/JNaZI:+ps3wPkfgwd9UvAP4fj4yYF4TaZW/rP
  • TLSH
    T14DD63340B789BAF5D02A5B728B12CF653533FF97AD110F97458B1C489F933A1AA0B1C9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  5b0b21ab0f10edc736d445bb9ea3a4dfcredential_accessdiscoveryhijackloadervidarloaderspywarestealer

  • Detects HijackLoader (aka IDAT Loader)

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Detects Windows executables referencing non-Windows User-Agents

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2