Extracted

Extracted

• • Target
    2026-09-04_8f9f573806b281e2201871dd8b9c8c69_elex_wannacry
  • Size 12.6MB
  • SHA256 0c24d19f46462aafd95ee60f0c7eba7258a2da74406603c92be03c10a9e6f464
  • MD5 8f9f573806b281e2201871dd8b9c8c69
  • SHA1 895ff92642717a0a644df40ed86e5a0c25d42515
  • SHA512 653596ced21294c081b3d6fe8b33270da99fa2967772213f493ce8f75ed7e4b51a9790b8a87179dced9fe7ba7b286b28b6a392cf01815f9467d05a90a32c54c4
  • SSDEEP 393216:+pRxxkKEk52udlmNfqGQdwE6j0phLPOFF4TaZW/rB:eX2cRdaHwphLPgszV
  • TLSH
    T167D633617BE168F4C27BD13B9F8B832A41F2EBA41B965AC756C50F886DD32E4061F1C4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  623bb8d9c6fdcf8c11a6131cec2eaf19credential_accessdiscoveryhijackloadervidarloaderspywarestealer

  • Detects HijackLoader (aka IDAT Loader)

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Detects Windows executables referencing non-Windows User-Agents

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Drops desktop.ini file(s)

  • Suspicious use of SetThreadContext

  behavioral1behavioral2