Hostile 100% Download

2026-09-26_1f4db223b2cb30125a061f460ebc889c_elex_wannacry

WannaCry ransomware with credential theft

Native binary stream-copies itself through autorun drivesProtected Storage passwords sent by URL-encoded HTTP POST
SHA-25644bb290dc975c368b0fc2f902ea9007745a2e896803b9e167653b192825de2bd
URLhttps://tria.ge/api/v0/samples/260927-c7zmjsxcqa/sample
MaleculeO₆(Ca₂EuLaAs₁₀C₂P₄)H₈(F₆Cm₅DbHfMgOs₄Po₅Ti)Md₄(Bi₉HeSi)Th

Evidence

UPX packed section name 0x3a0–0x650
⋯5 more rows
0x3f000000000000000000000000000000000................
0x40000000000000000000000000000000000................
0x41000000000000000000000000000000000................
0x42000000000000000000000000000000000................
⋯35 more rows
PE imports ordinal 1 by number 0x25f80–0x26200
⋯7 more rows
0x25ff0bc001417058f67405ea0dddc25773d28......g@^...%w=(
0x26000190ef59ce9e9361d212d1a1dd21bcb77......6.!-.....w
0x2601083faf5fdb2f33c29dc0ab7bd00cb179c......<)........
0x2602093e9240a45fd83009420cd64961976f9..$.E.... .d..v.
0x26030176582400b7c28c54808ca2482f90994.e.@.|(.H..$....
0x2604037440528617597eb44018634fcf2289b7D.(au..D..4..(.
0x2605079e2dc2de30a00db29fb010e88217526y..-....)....!u&
0x2606089666fc081d8be031a37f1fa3025156f.fo......7..0%.o
0x26070f9abc69dd40b111da681fb5a29e16128...........Z).a(
0x260802bc5d1c78e38dca415ad31ed01f8894d+....8....1....M
0x26090c75bc206ed8d5e582d7e60be61e1f901.[....^X-~`.a...
0x260a0250719dd069cb71d819135dd336ac215%.........5.3j..
0x260b05f5c39fa35016b6096da75018279f951_\9.5.k`..u..y.Q
0x260c019438b81ca76fa195808e905ca0c9c47.C...v..X......G
0x260d085cdfa0580451b2164fe7790d9b5050d.....E.!d.w.....
0x260e0081535e59d3db3b50237e1338119051a..5..=...7.3....
0x260f087444d0a5612caff818808216c9f19c6.DM.V......!l...
0x26100bfb698c46f237112090b30e8dd9e0381....o#q...0.....
0x261105d49ce6f061e7da68796a834cd2ad109]I.o..}....4.*..
0x2612060d8011909e31bae454719eedb8483c3`.......EG......
0x261300d1d581c151f0b8c22fe4de62611ee0c..X.....".M.&...
0x2614001159cb4ea14d386e9094015442d18f3[email protected]..
0x2615019f70819f12d34214a2549a5826ccb25.....-4!J%I..l.%
0x26160c30018eebb0ab16dc203cc700215c8c6.......m...p....
0x26170245a07e435d45935662e663701b85935$Z..5.Y5f.f7..Y5
0x261803d9ace94dd35dc4e7935d864ccb2c5b2=....5.Ny5.d....
0x26190593dc18ba889dc2e09bc37e1c3fc3042Y=........7...0B
⋯7 more rows
XOR-decoded WinINet HTTP APIs 0x269f4–0x26ce4
⋯8 more rows
0x26a746b6e67437676706b6077766771430000kngCvvpk`wvgqC..
0x26a8450676551677654636e7767477a430000PgeQgvTcnwgGzC..
0x26a945067654d72676c49677b430050676541PgeMrglIg{C.PgeA
0x26aa46e6d716749677b006a767672382d2d60nmqgIg{.jvvr8--`
0x26ab477606e6b696b63666f6b6c6b71767063w`nkikcfoklkqvpc
0x26ac4766d702c616d6f2d000000006a767672vmp,amo-....jvvr
0x26ad4382d2d6077606e6b696b6f636c6365678--`w`nkikoclceg
0x26ae4702c616d6f2d00006f6c645f6c6f6164p,amo-..old_load
0x26af4000000005d5d5d5d5d5d5d5d005f5f5f....]]]]]]]].___
0x26b045f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f________________
0x26b145f5f5f5f5f5f5f5f5f5f5f5f5f000000_____________...
0x26b246065776e6c6d2d667b66000077746b6b`ewnlm-f{f..wtkk
0x26b3468772a617c610000706266252538727ahw*a|a..pbf%%8rz
0x26b447a000000633a5c73746f7000666c6962z...c:\stop.flib
0x26b5400000000756b6c6b6c67762c666e6e00....uklklgv,fnn.
0x26b644b6c7667706c67764d72676c43000000KlvgplgvMrglC...
0x26b744b6c7667706c67764d72676c57706e43KlvgplgvMrglWpnC
0x26b84000000004b6c7667706c677650676366....KlvgplgvPgcf
⋯12 more rows
0x26c54737474636872506374756f69685a5473sttchrPctuoihZTs
0x26c64685a0000496d61676550617468000000hZ..ImagePath...
0x26c74515b5156474f5e41777070676c76416dQ[QVGO^AwppglvAm
0x26c846c76706d6e5167765e516770746b6167lvpmnQgv^Qgptkag
0x26c94715e51616a6766776e67000022253122q^Qajgfwng.."%1"
0x26ca420252a00202225312220252a00000000 %*. "%1" %*....
⋯4 more rows
Autorun ShellExecute starts executable 0x26e40–0x27130
⋯3 more rows
0x26e70676c616d666766002f0000002f000000glamfgf./.../...
0x26e80504f535420257320485454502f312e31POST %s HTTP/1.1
0x26e900d0a486f73743a2025730d0a436f6e74..Host: %s..Cont
0x26ea0656e742d547970653a206170706c6963ent-Type: applic
0x26eb06174696f6e2f782d7777772d666f726dation/x-www-form
0x26ec02d75726c656e636f6465640d0a436f6e-urlencoded..Con
0x26ed074656e742d6c656e6774683a2025640dtent-length: %d.
0x26ee00a0d0a25730000000a000000233a5c00...%s.......#:\.
0x26ef06377766d70776c2c677a67006377766dcwvmpwl,gzg.cwvm
0x26f0070776c2c6b6c64007700000059637776pwl,kld.w...Ycwv
0x26f106d70776c5f0000000d0a0000516a676empwl_.......Qjgn
0x26f206e477a67617776673f6377766d70776cnGzgawvg?cwvmpwl
0x26f302c677a67000000007067652266676e67,gzg....pge"fgng
0x26f40766722204a494e4f5e514d4456554350vg" JINO^QMDVUCP
0x26f50475e4f6b61706d716d64765e556b6c66G^Okapmqmdv^Uklf
0x26f606d75715e41777070676c76546770716bmuq^AwppglvTgpqk
0x26f706d6c5e477a726e6d7067705e40706d75ml^Gzrnmpgp^@pmu
0x26f80716770224a676e726770224d60686761qgp"Jgnrgp"M`hga
0x26f90767120222d6400004578706c6f726572vq "-d..Explorer
0x26fa02e657865000000005368656c6c000000.exe....Shell...
0x26fb0514d4456554350475e4f6b61706d716dQMDVUCPG^Okapmqm
0x26fc064765e556b6c666d7571224c565e4177dv^Uklfmuq"LV^Aw
0x26fd07070676c76546770716b6d6c5e556b6cppglvTgpqkml^Ukl
0x26fe06e6d656d6c5e00006c6f676f6e75692enmeml^..logonui.
0x26ff0657865005549486f73740000514d4456exe.UIHost..QMDV
⋯3 more rows
0x270306c5e00005c75736572696e69742e6578l^..\userinit.ex
0x27040652c000055736572496e697400000000e,..UserInit....
0x27050514d4456554350475e4f6b61706d716dQMDVUCPG^Okapmqm
0x2706064765e556b6c666d7571224c565e4177dv^Uklfmuq"LV^Aw
0x270707070676c76546770716b6d6c5e556b6cppglvTgpqkml^Ukl
0x270806e6d656d6c5e00007067652266676e67nmeml^..pge"fgng
0x27090766722204a494e4f5e514d4456554350vg" JINO^QMDVUCP
0x270a0475e4f6b61706d716d64765e556b6c66G^Okapmqmdv^Uklf
0x270b06d75715e41777070676c76546770716bmuq^AwppglvTgpqk
0x270c06d6c5e50776c20222d64000070676522ml^Pwl "-d..pge"
0x270d066676e67766722204a4941575e514d44fgngvg" JIAW^QMD
0x270e056554350475e4f6b61706d716d64765eVUCPG^Okapmqmdv^
0x270f0556b6c666d75715e41777070676c7654Uklfmuq^AwppglvT
0x271006770716b6d6c5e50776c20222d640000gpqkml^Pwl "-d..
0x271107067652266676e67766722204a494e4fpge"fgngvg" JINO
0x271205e514d4456554350475e4f6b61706d71^QMDVUCPG^Okapmq
0x271306d64765e556b6c666d75715e41777070mdv^Uklfmuq^Awpp
Call to GetDriveTypeA by raw bytes 0x2c3ed–0x2c6dd
⋯10 more rows
0x2c48d7400016c737472636d704100016c7374t..lstrcmpA..lst
0x2c49d726370796e4100014765744c6f676963rcpynA..GetLogic
0x2c4ad616c4472697665537472696e67734100alDriveStringsA.
0x2c4bd01476574447269766554797065410001.GetDriveTypeA..
0x2c4cd6c7374726c656e4100016c7374726361lstrlenA..lstrca
⋯8 more rows
0x2c55d63657373410001436c6f736548616e64cessA..CloseHand
0x2c56d6c65000150726f6365737333324e6578le..Process32Nex
0x2c57d74000150726f63657373333246697273t..Process32Firs
0x2c58d740001437265617465546f6f6c68656ct..CreateToolhel
0x2c59d703332536e617073686f740001437265p32Snapshot..Cre
0x2c5ad6174655468726561640001476c6f6261ateThread..Globa
⋯11 more rows
0x2c66d66000161746f69000166636c6f736500f..atoi..fclose.
0x2c67d016674656c6c0001667365656b000166.ftell..fseek..f
0x2c68d6f70656e0001746f757070657200015fopen..toupper.._
⋯5 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.