Hostile ^100% Download

2026-09-29_62374e770d5fda3ed5926824c7cdba8f_elex_wannacry

WannaCry ransomware with DDoS payload

StormAttack DDoS component identityVendor-signed PE modified after signing

SHA-256227637f44566aae0f8c839af240c75da9797557df8177274f3bbb022d28a2242

URLhttps://tria.ge/api/v0/samples/260929-3qt9lshg32/sample

MaleculeK(Mc)O₄(Er₇As₂P₂Pr)H₇(CmDbDsF₃MgOs₁₀Po₅)Md₃(Bi₆Si₄)Th

Evidence

x86 indirect call through a global pointer 0x13c5–0x1505

⋯3 more rows
0x13f568010000689c43400051ff1544304000[email protected]@.
0x14058b35403040008d5424648d8424680100.5@[email protected]$d..$h..
0x1415005250ffd68d8c246801000068944340.RP....$h...h.C@
⋯4 more rows
0x146500894c2420c744242444000000c74424..L$ .D$$D....D$
0x14755001000000ffd38b358430400050ffd6[email protected]..
0x14858b2d883040006a0fffd58b3d8c304000[email protected]....=.0@.
0x149550ffd78d5424108d44242052506a006aP...T$..D$ RPj.j
⋯7 more rows

Copy files (Windows API ANSI) 0x2fc4–0x31e4

⋯3 more rows
0x2ff40000000000000000000000009c368777.............6.w
0x300407498777ef48877753358a7701cd8677.I.w.H.wS5.w...w
0x3014c3348a77a6c7867715cc8677eaa48877.4.w...w...w...w
0x3024b31487779d468777f02b877758318a77...w.F.w.+.wX1.w
0x3034d82b877743358a77000000007a2b5276.+.wC5.w....z+Rv
0x30449d2a5276a03350764d595276b1145076.*Rv.3PvMYRv..Pv
0x3054c0115076040000000000000000000000..Pv............
0x306400000000000000000000000000000000................
0x3074000000007b46363342373042392d3242....{F63B70B9-2B
0x308438452d343461332d423234372d4242418E-44a3-B247-BBA
0x30943439373436344535397d00764b5a5076497464E59}.vKZPv
0x30a4b0d95176e0d951764512507622125076..Qv..QvE.Pv".Pv
0x30b46b415876aa9752766cb6517682125076kAXv..Rvl.Qv..Pv
0x30c40000000084c358753ab15675ebbf5675......Xu:.Vu..Vu
0x30d4701d57754a1b57750000000008e55075p.WuJ.Wu......Pu
0x30e489f6507582f55075b6e2507500000000..Pu..Pu..Pu....
0x30f4e1e1b4760428b5769534b6767cfab676...v.(.v.4.v|..v
0x31049498b476ac76b576793db576c8f3b576...v.v.vy=.v...v
0x3114ee9cb476ea22b67606f6b576c4b2b576...v.".v...v...v
0x3124aa36b5764adeb47643b4b47670d7b676.6.vJ..vC..vp..v
0x313409f5b4762d11b576c0b2ba7675dcb676...v-..v...vu..v
⋯11 more rows

Binary imports ADVAPI32.dll 0x349a–0x378a

⋯5 more rows
0x34ea696e646f77734469726563746f727941indowsDirectoryA
0x34fa0000640043726561746552656d6f7465..d.CreateRemote
0x350a5468726561640000980147657450726fThread....GetPro
0x351a6341646472657373000077014765744dcAddress..w.GetM
0x352a6f64756c6548616e646c65410000a003oduleHandleA....
0x353a577269746550726f636573734d656d6fWriteProcessMemo
0x354a7279000076035669727475616c416c6cry..v.VirtualAll
0x355a6f6345780000bf036c7374726c656e41ocEx....lstrlenA
0x356a0000600043726561746550726f636573..`.CreateProces
⋯8 more rows
0x35fa6c737472636174410000b9036c737472lstrcatA....lstr
0x360a6370794100005001476574456e766972cpyA..P.GetEnvir
0x361a6f6e6d656e745661726961626c654100onmentVariableA.
0x362aad0147657453686f7274506174684e61..GetShortPathNa
⋯22 more rows

StormAttack DDoS server banner (unpacked .data) 0x3fa0–0x4210

⋯7 more rows
0x401000000000000000000000000000000000................
0x402053746f726d5365727665722e646c6c00StormServer.dll.
0x403000000000000000000000000000000000................
0x404000000000000000000000000000000000................
0x405000000000000000000000000000000000................
⋯11 more rows
0x411000000000000000000000000000000000................
0x4120030000000000000053746f726d206464........Storm dd
0x41306f732053657276657200000000000000os Server.......
0x4140000000000000000057656c636f6d6520........Welcome 
0x4150746f207573652073746f726d2064646fto use storm ddo
0x416073000000000000000000000000000000s...............
0x417000000000000000000000000000000000................
0x418000000000000000000000000000000000................
0x419000000000000000000000000000000000................
0x41a000000000000000000000000000000000................
⋯7 more rows

Percent-encoded content decoded 0x42a0–0x44e0

⋯5 more rows
0x42f063616c632e657865000000006e6f7465calc.exe....note
0x43007061642e65786500696578706c6f7265pad.exe.iexplore
0x43102e657865000000004b65726e656c3332.exe....Kernel32
0x4320000000004c6f61644c69627261727941....LoadLibraryA
0x43300000000053657276696365444c4c0000....ServiceDLL..
0x434053595354454d5c43757272656e74436fSYSTEM\CurrentCo
0x43506e74726f6c5365745c53657276696365ntrolSet\Service
0x4360735c4c616e6d616e5365727665725c50s\LanmanServer\P
0x43706172616d657465727300000025537973arameters...%Sys
0x438074656d526f6f74255c53797374656d33temRoot%\System3
0x4390325c0000203e206e756c0000202f63202\.. > nul.. /c 
0x43a02064656c20000000434f4d5350454300 del ...COMSPEC.
0x43b0444c4c007b253038582d253034582d25DLL.{%08X-%04X-%
0x43c03034782d25303258253032582d25303204x-%02X%02X-%02
0x43d058253032582530325825303258253032X%02X%02X%02X%02
0x43e058253032587d00007762000072620000X%02X}..wb..rb..
0x43f0737475627061746800000000534f4654stubpath....SOFT
0x4400574152455c4d6963726f736f66745c41WARE\Microsoft\A
0x441063746976652053657475705c496e7374ctive Setup\Inst
0x4420616c6c656420436f6d706f6e656e7473alled Components
0x44305c0000002e6578650000000044657363\....exe....Desc
0x444072697074696f6e0053595354454d5c43ription.SYSTEM\C
0x4450757272656e74436f6e74726f6c536574urrentControlSet
0x44605c53657276696365735c00002e455845\Services\...EXE
0x447000000000000000000000000000000000................
⋯7 more rows