Extracted

• • Target
    2026-11-02_d16547ddc963dfeb1f2ec4c9d042ad26_coinminer_elex_wannacry
  • Size 6.8MB
  • SHA256 9406d3a741e43582e3db87aed679daa81b64c8597585c3f583453010358b7421
  • MD5 d16547ddc963dfeb1f2ec4c9d042ad26
  • SHA1 01611c174144da1bb5575d3a24166e0537cc9060
  • SHA512 6566e1e0b03bec56dab1e1949e50470fee8c4298ef57221e43e875a7bbb5bbf1757915ae2fecca7537e2893b8c353e92a95abf43c93d057641de91ee2c305d46
  • SSDEEP 196608:+pvfbbbNGjtTAAptysGqXuKPzF5JNJs17:+pLXNctTw8zF5nJm
  • TLSH
    T1DA763311B78165F2EAD5C5B0CF5CF3330933EBABA252A987D3A25E422EBA1F411075C5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryhijackloaderloaderprivilege_escalation

  • Detects HijackLoader (aka IDAT Loader)

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2