Extracted

Extracted

Extracted

Extracted

• • Target
    2026-09-23_884f22cd93dd27ebd7aabcd787439f60_elex_wannacry
  • Size 14.9MB
  • SHA256 99fd5b5574063d071c7b65e8e4b626dcdf429410085847a13e702bc7c305481e
  • MD5 884f22cd93dd27ebd7aabcd787439f60
  • SHA1 7ee34aac1947fc60e9a987ba09c03569ded08639
  • SHA512 44b9698c77b0221d3f1674cade9dba11c859358238a8208ecc932cbdb464b537c0ac76a1b770568863cd49f9126280d1f667594ea3430fc38e8a394489eb1803
  • SSDEEP 393216:xt5jj66jAiL0DXMoj2pJuG83GO+7AIXs/JDL/GBn:5j6sAA0DXxG8WOxQsRDL/c
  • TLSH
    T184F633637CC8D07CDF25D235498877E14BF6A619DE5349EB23A88C0407FA296EE8F161
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2@tuiuser1defense_evasiondiscoverydropperexecutionfabookiegluptebanullmixerprivateloaderraccoonredlinesocelarsinfostealerinstallerloaderpersistenceprivilege_escalationrootkitspywarestealertrojan

  • Detect Fabookie payload

  • Family: Fabookie

    Fabookie is facebook account info stealer.

    spywarestealerfabookie

  • Family: Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Family: NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

    droppernullmixer

  • Family: PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader

  • Family: Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Family: Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars

  • Raccoon Stealer V1 payload

  • RedLine payload

  • Socelars payload

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables packed with ASPack

  • Detects executables packed with unregistered version of .NET Reactor

  • Detects executables referencing many email and collaboration clients. Observed in information steale

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Modifies Windows Firewall

    defense_evasion

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • System Binary Proxy Execution: Odbcconf

    Abuse Odbcconf to proxy execution of malicious code.

    defense_evasion

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops Chrome extension

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Manipulates WinMonFS driver.

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitdefense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2