Extracted

• • Target
    2026-11-01_84a06ef871892c9a31c9a4a70bce6fff_elex_wannacry
  • Size 17.2MB
  • SHA256 83add24600d6e5ca6681bcb1bd9b2c900af4f80629443f6d4ab7da34740325a5
  • MD5 84a06ef871892c9a31c9a4a70bce6fff
  • SHA1 d047f0cf6d887b71c67d80507385281cac270b4f
  • SHA512 eee8e732da5cffd750871ef3a84aa806361fc2601565ad4bb6bc9a158110f9ce425497dbe150351e9541ddb3d502ded8c6401a19b1cebdffd02f96a2b0158b1a
  • SSDEEP 393216:+pYwkoanZjd7S2iAiJT23JH/XZbGCUFmXQ+UVjg/:eYAIj74CuFmHUhg/
  • TLSH
    T19E0733007334BFBEC31ADDB29F419BA246B0D58A55108D83ED924E386D83DBB115BAF5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryhijackloaderloaderprivilege_escalationspywarestealer

  • Detects HijackLoader (aka IDAT Loader)

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2