Hostile ^92% Download

2026-10-02_b8c741776e2d4966cf5a3b8bafcef17d_coinminer_elex_wannacry

WannaCry ransomware indicators

Detects WannaCry RansomwareLarge PE is dominated by zero-like filler

SHA-25636395cbaf9f87f05d0a8db8ef184e1aa61c5d7a76daa18882885a389b88b5614

URLhttps://tria.ge/api/v0/samples/261003-fgmf3sswds/sample

MaleculeO₅(PAlAs₆CEr)H₇(CmCr₂Db₂F₆MgOs₇Po₄)Md₃(Bi₆Si)Th

Evidence

x86 indirect call through a global pointer 0xfc0–0x12b0

⋯3 more rows
0xff000000000000000000000000000000000................
0x10005633f63974240c577407681ce04000ebV3.9t$.Wt.h..@..
0x1010056818e040006810e04000ff15188140[email protected]..@.....@
0x1020008bf8593bfe59750433c0eb34397424...Y;.Yu.3..49t$
⋯5 more rows
0x10807df48975f0ababab6a018d45f05f6689}..u....j..E._f.
0x109075dc508d45ac50565668000000085656u.P.E.PVVh....VV
0x10a056897dd8ff750856ff15ec80400085c0V.}..u.V....@...
0x10b0744539750c742cff750cff75f0ff15f4tE9u.t,.u..u....
0x10c080400085c0740b6affff75f0ff15f880[email protected].....
0x10d04000397510740cff7510ff75f0ff15fc@.9u.t..u..u....
0x10e0804000ff75f08b35f0804000ffd6ff75[email protected][email protected]
0x10f0f4ffd68bc7eb0233c05f5ec9c3558bec.......3._^..U..
0x110081ecdc02000056576a05be4ce0400059[email protected]
⋯20 more rows
0x1250f3ab66ab8d45f8508d8568feffff50ff..f..E.P..h...P.
0x126015d08040008b35388140008365fc006a[email protected][email protected]
0x1270018d8568feffff5b50ffd685c0597620...h...[P....Yv 
⋯4 more rows

Detects WannaCry Ransomware 0x2248–0x23c8

⋯7 more rows
0x22b851ffd08b45dc8b57508d7402ff8b55fcQ...E..WP.t...U.
0x22c88d48fff7d18d4410ff23f123c13bf00f.H....D..#.#.;..
0x22d88537ffffffff75246a04680030000056.7....u$j.h.0..V
⋯15 more rows

Large null run in executable (64+ bytes) 0x7970–0x7ae0

⋯3 more rows
0x79a044fdffff59c3b880d54000e910fdffffD...Y....@......
0x79b000000000000000000000000000000000................
0x79c000000000000000000000000000000000................
0x79d000000000000000000000000000000000................
0x79e000000000000000000000000000000000................
0x79f000000000000000000000000000000000................
0x7a0000000000000000000000000000000000................
0x7a1000000000000000000000000000000000................
0x7a2000000000000000000000000000000000................
0x7a3000000000000000000000000000000000................
0x7a4000000000000000000000000000000000................
0x7a5000000000000000000000000000000000................
0x7a6000000000000000000000000000000000................
0x7a7000000000000000000000000000000000................
⋯7 more rows

Open service control manager 0x7fa0–0x8230

⋯5 more rows
0x7ff000000000000000000000000000000000................
0x80002adc000062dc000052dc00003cdc0000*...b...R...<...
0x801014dc000004dc0000f2db0000dedb0000................
0x8020d0db000072dc000000000000fcd80000....r...........
0x803012d9000022d9000030d900004cd90000...."...0...L...
0x804064d9000070d900007ed900008ad90000d...p...~.......
0x8050a2d90000bad90000d0d90000e8d90000................
0x8060fcd900000cda000024da00003ada0000........$...:...
0x80704cda00005cda0000e6d800007cda0000L...\.......|...
0x808084da000092da0000a6da0000b2da0000................
0x8090c8da0000d8da0000e6da0000f4da0000................
0x80a000db000012db000026db000036db0000........&...6...
0x80b048db000058db000064db00007cdb0000H...X...d...|...
0x80c096db00005edf0000d4d80000c6d80000....^...........
0x80d0b2d800009ad8000082d8000074d80000............t...
0x80e064d8000052d8000044d8000032d80000d...R...D...2...
0x80f0e4d700001cd8000008d80000f2d70000................
0x81006cda000000000000dcdd0000b8dc0000l...............
0x8110c2dc0000ccdc0000d4dc0000dcdc0000................
0x8120e6dc0000eedc0000f6dc000000dd0000................
0x81300add000014dd00001edd000028dd0000............(...
⋯16 more rows

AES S-box table in PE rdata 0x89bc–0x8a8c

⋯3 more rows
0x89ecc0000000f70000007000000007000000........p.......
0x89fc637c777bf26b6fc53001672bfed7ab76c|w{.ko.0.g+...v
0x8a0cca82c97dfa5947f0add4a2af9ca472c0...}.YG.......r.
0x8a1cb7fd9326363ff7cc34a5e5f171d83115...&6?..4...q.1.
⋯7 more rows