Extracted

• • Target
    2026-10-17_3c4d4e718a0fd6c856f1433c2b0c0ea7_coinminer_elex_wannacry
  • Size 5.1MB
  • SHA256 1591dc2dd32dc9b5a43ce5c1c01ec18800c54ad3dc6373fd5945453021908f1e
  • MD5 3c4d4e718a0fd6c856f1433c2b0c0ea7
  • SHA1 5de69a734fa437217da95d6e0586da2b9865533a
  • SHA512 1500bc67894a24d6c319c6b69e823419cfc2c59c9a8947146feb26e0d6c48cc75cfc480493bd84a25616e4b02bd04fcaf1df13b5435d4c06ffc7e3eb0eedd298
  • SSDEEP 98304:+p0uTJ9gAmuhKlQHHCg8Wyl2ljnI7U6qz7iUX4UqTcF3jb7pm6:+p0u19GuhK6Hig8WVIgZGUXRqTEf
  • TLSH
    T186363319BBE06CB0C1325B73DF7CEF4281B2C78265901EC396958ED59E536E20247BE9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryhijackloaderloaderprivilege_escalationcredential_accessspywarestealer

  • Detects HijackLoader (aka IDAT Loader)

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2