2026-09-28_50ce211b09f05db9f6c043b62d58d429_destroyer_elex_glassworm_ngrbot_wannacry
Ransomware with keylogger and C2
.NET AES file encryptor with ransom demands.NET low-level hook keylogger with HTTP upload
SHA-2568c0a9fc0b685050a65e0702a4ff4b7b2f3ba6377fcab4d626a1d180911f97397
Evidence
0x54d4726f390070281300000a802b00000472ro9.p(.....+...r
0x54e47d390070802c0000047e260000047293}9.p.,...~&...r.
0x54f4390070281300000a802d00000428a9009.p(.....-...(..
0x5504000a72ad3900706f9d00000a802e0000..r.9.po........
0x55140428a900000a72d13900706f9d00000a.(....r.9.po....
0x5524802f0000047e6100000a803100000473./...~a....1...s
0x5534c700000a803200000472ff0100708033.....2...r...p.3
0x554400000472ff01007080340000042a0000...r...p.4...*..
0x555442534a4201000100000000000c000000BSJB............
0x556476342e302e3330333139000000000500v4.0.30319......
0x55746c0000009c1c0000237e0000081d0000l.......#~......
0x5584c822000023537472696e677300000000."..#Strings....
0x5594d03f0000f439000023555300c4790000.?...9..#US..y..
0x55a4100000002347554944000000d4790000....#GUID....y..
0x55b4e40b000023426c6f6200000000000000....#Blob.......
0x55c402000001579f023e090a000000fa2533....W..>......%3
0x55d40016000001000000690000000f000000........i.......
0x55e47e000000a30000005f00000009000000~......._.......
0x55f4c7000000210000006300000001000000....!...c.......
0x560444000000120000000300000002000000D...............
0x56141c000000010000000100000005000000................
0x56240c0000001200000000000a0001000000................
0x56340000060066005f0006006d005f000600....f._...m._...
0x5644a7039b030600f905e2050600240b5f00............$._.
0x56540600310b ..1.
0xa2b10077006f007a002e006e0073002e0063.w.o.z...n.s...c
0xa2c1006c006f007500640066006c00610072.l.o.u.d.f.l.a.r
0xa2d10065002e0063006f006d000017410070.e...c.o.m...A.p
0xa2e10070006c00690063006100740069006f.p.l.i.c.a.t.i.o
0xa2f1006e00001f5300650072007600690063.n...S.e.r.v.i.c
0xa30100650020007300740061007200740065.e. .s.t.a.r.t.e
0xa311006400005b53004f0046005400570041.d..[S.O.F.T.W.A
0xa32100520045005c004d006900630072006f.R.E.\.M.i.c.r.o
0xa3310073006f00660074005c00570069006e.s.o.f.t.\.W.i.n
0xa3410064006f00770073005c004300750072.d.o.w.s.\.C.u.r
0xa35100720065006e00740056006500720073.r.e.n.t.V.e.r.s
0xa3610069006f006e005c00520075006e0000.i.o.n.\.R.u.n..
0xa37113530079007300550070006400610074.S.y.s.U.p.d.a.t
0xa381006500001b5300790073005500700064.e...S.y.s.U.p.d
0xa391006100740065002e0065007800650000.a.t.e...e.x.e..
0xa3a1117300630068007400610073006b0073.s.c.h.t.a.s.k.s
0xa3b10000432f006300720065006100740065..C/.c.r.e.a.t.e
0xa3c10020002f0074006e0020002200530079. ./.t.n. .".S.y
0xa3d100730055007000640061007400650054.s.U.p.d.a.t.e.T
0xa3e100610073006b00220020002f00740072.a.s.k.". ./.t.r
0xa3f100200022000021220020002f00730063. ."..!". ./.s.c
0xa4010020006f006e006c006f0067006f006e. .o.n.l.o.g.o.n
0xa4110020002f00660000472f006300720065. ./.f..G/.c.r.e
0xa4210061007400650020002f0074006e0020.a.t.e. ./.t.n.
0xa43100220053007900730055007000640061.".S.y.s.U.p.d.a
0xa44100740065004200610063006b00750070.t.e.B.a.c.k.u.p
0xa45100220020002f00740072002000220000.". ./.t.r. ."..
0xa4612d220020002f007300630020006d0069-". ./.s.c. .m.i
0xa471006e0075007400650020002f006d006f.n.u.t.e. ./.m.o
0xa4810020003300300020002f006600000320. .3.0. ./.f...
0xa4910000155b00480048003a006d006d003a...[.H.H.:.m.m.:
0xa4a100730073005d00000520002800000529.s.s.]... .(...)
0xa4b100200000050d000a00000f4b00450059. .........K.E.Y
0xa4c1004c004f0047003a0000035b0000055d.L.O.G.:...[...]
0xa4d100200000030a00000b43004c00490050. .......C.L.I.P
0xa4e1003a0000097300630072005f00001f79.:...s.c.r._...y
0xa4f1007900790079004d004d00640064005f.y.y.y.M.M.d.d._
0xa50100480048006d006d007300730000092e.H.H.m.m.s.s....
0xa511006a0070006700000f53004300520045.j.p.g...S.C.R.E
0xa5210045004e003a00001344006f0077006e.E.N.:...D.o.w.n
0xa531006c006f0061006400730000092e0074.l.o.a.d.s.....t
0xa541007800740000092e0064006f00630000.x.t.....d.o.c..
0xa5510b2e0064006f006300780000092e0070...d.o.c.x.....p
0xa561006400660000092e0078006c00730000.d.f.....x.l.s..
0xa5710b2e0078006c007300780000092e0070...x.l.s.x.....p
0xa581006e00670000092e007a006900700000.n.g.....z.i.p..
0xa591032a00000f2e00730074006f006c0065.*.....s.t.o.l.e
0xa5a1006e00000b460049004c0045003a0000.n...F.I.L.E.:..
0xab252d002d00200042006100730065003600-.-. .B.a.s.e.6.
0xab353400200062006f0074006e00650074004. .b.o.t.n.e.t.
0xab453a0020000180ab0d000a002d002d0020:. ........-.-.
0xab5500540068006900730020005000440046.T.h.i.s. .P.D.F
0xab6500200063006f006e007400610069006e. .c.o.n.t.a.i.n
0xab750073002000610020006d0061006c0077.s. .a. .m.a.l.w
0xab85006100720065002e00200050006c0065.a.r.e... .P.l.e
0xab95006100730065002000720075006e0020.a.s.e. .r.u.n.
0xaba500740068006500200061007400740061.t.h.e. .a.t.t.a
0xabb500630068006500640020006500780065.c.h.e.d. .e.x.e
0xabc500630075007400610062006c00650020.c.u.t.a.b.l.e.
0xabd50074006f002000760069006500770020.t.o. .v.i.e.w.
0xabe50063006f006e00740065006e0074002e.c.o.n.t.e.n.t..
0xabf5000180810d000a005300650074002000........S.e.t. .
0xac056f005700530020003d00200057005300o.W.S. .=. .W.S.
0xac15630072006900700074002e0043007200c.r.i.p.t...C.r.
0xac2565006100740065004f0062006a006500e.a.t.e.O.b.j.e.
0xac3563007400280022005700530063007200c.t.(.".W.S.c.r.
0xac456900700074002e005300680065006c00i.p.t...S.h.e.l.
0xac556c00220029000d000a0073004c006900l.".).....s.L.i.
0xac656e006b00460069006c00650020003d00n.k.F.i.l.e. .=.
0xac7520002200002d49006d0070006f007200 ."..-I.m.p.o.r.
0xac85740061006e0074005f0044006f006300t.a.n.t._.D.o.c.
0xac9575006d0065006e0074002e006c006e00u.m.e.n.t...l.n.
0xaca56b0000808522000d000a005300650074k....".....S.e.t
0xacb50020006f004c0069006e006b0020003d. .o.L.i.n.k. .=
0xacc50020006f00570053002e004300720065. .o.W.S...C.r.e
0xacd500610074006500530068006f00720074.a.t.e.S.h.o.r.t
0xace500630075007400280073004c0069006e.c.u.t.(.s.L.i.n
0xacf5006b00460069006c00650029000d000a.k.F.i.l.e.)....
0xad05006f004c0069006e006b002e00540061.o.L.i.n.k...T.a
0xad1500720067006500740050006100740068.r.g.e.t.P.a.t.h
0xad250020003d0020002200001b22000d000a. .=. ."..."....
0xad35006f004c0069006e006b002e00530061.o.L.i.n.k...S.a
0xad45007600650000176d0061006b0065006c.v.e...m.a.k.e.l
0xad55006e006b002e00760062007300001777.n.k...v.b.s...w
0xad65007300630072006900700074002e0065.s.c.r.i.p.t...e
0xad750078006500002f530079007300740065.x.e../S.y.s.t.e
0xad85006d0056006f006c0075006d00650049.m.V.o.l.u.m.e.I
0xad95006e0066006f0072006d006100740069.n.f.o.r.m.a.t.i
0xada5006f006e00000964006f0063005f0000.o.n...d.o.c._..
0xadb52742006f0074006e0065007400200050'B.o.t.n.e.t. .P
0xadc50044004600200063006f006e00740065.D.F. .c.o.n.t.e
0xadd5006e0074002000001350004400460042.n.t. ...P.D.F.B
0xade5006f0074006e00650074000039500044.o.t.n.e.t..9P.D
0xadf500460042006f0074006e00650074005c.F.B.o.t.n.e.t.\
0xae05007300680065006c006c005c006f0070.s.h.e.l.l.\.o.p
0xae150065006e005c0063006f006d006d0061.e.n.\.c.o.m.m.a
0xb6e878006500000d77007300630073007600x.e...w.s.c.s.v.
0xb6f86300002b530065006300750072006900c..+S.e.c.u.r.i.
0xb708740079004800650061006c0074006800t.y.H.e.a.l.t.h.
0xb71853006500720076006900630065000013S.e.r.v.i.c.e...
0xb728570069006e0044006500660065006e00W.i.n.D.e.f.e.n.
0xb7386400000f4d0073004d00700053007600d...M.s.M.p.S.v.
0xb7486300000573006300000b730074006f00c...s.c...s.t.o.
0xb75870002000000f63006f006e0066006900p. ...c.o.n.f.i.
0xb76867002000002120007300740061007200g. ..! .s.t.a.r.
0xb77874003d00200064006900730061006200t.=. .d.i.s.a.b.
0xb7886c0065006400001b6b00610073007000l.e.d...k.a.s.p.
0xb7986500720073006b0079002e0063006f00e.r.s.k.y...c.o.
0xb7a86d0000156d0063006100660065006500m...m.c.a.f.e.e.
0xb7b82e0063006f006d000019730079006d00..c.o.m...s.y.m.
0xb7c861006e007400650063002e0063006f00a.n.t.e.c...c.o.
0xb7d86d000013610076006100730074002e00m...a.v.a.s.t...
0xb7e863006f006d00001f6200690074006400c.o.m...b.i.t.d.
0xb7f86500660065006e006400650072002e00e.f.e.n.d.e.r...
0xb80863006f006d0000116500730065007400c.o.m...e.s.e.t.
0xb8182e0063006f006d00001d740072006500..c.o.m...t.r.e.
0xb8286e0064006d006900630072006f002e00n.d.m.i.c.r.o...
0xb83863006f006d0000216d0061006c007700c.o.m..!m.a.l.w.
0xb84861007200650062007900740065007300a.r.e.b.y.t.e.s.
0xb8582e0063006f006d00001d760069007200..c.o.m...v.i.r.
0xb8687500730074006f00740061006c002e00u.s.t.o.t.a.l...
0xb87863006f006d0000153100320037002e00c.o.m...1.2.7...
0xb88830002e0030002e0031002000001b57000...0...1. ...W.
0xb89861006e006e0061004300720079004d00a.n.n.a.C.r.y.M.
0xb8a8750074006500780000194c006f006300u.t.e.x...L.o.c.
0xb8b86b004200690074004d00750074006500k.B.i.t.M.u.t.e.
0xb8c878000021480069006400640065006e00x..!H.i.d.d.e.n.
0xb8d8540065006100720073004d0075007400T.e.a.r.s.M.u.t.
0xb8e86500780000135200790075006b004d00e.x...R.y.u.k.M.
0xb8f875007400650078000015520045007600u.t.e.x...R.E.v.
0xb90869006c004d007500740065007800000fi.l.M.u.t.e.x...
0xb91847006c006f00620061006c005c000029G.l.o.b.a.l.\..)
0xb928520061006e0073006f006d0077006100R.a.n.s.o.m.w.a.
0xb93872006500530069006d0075006c006100r.e.S.i.m.u.l.a.
0xb948740069006f006e000045460069006c00t.i.o.n..EF.i.l.
0xb95865007300200065006e00630072007900e.s. .e.n.c.r.y.
0xb96870007400650064002e00200050006100p.t.e.d... .P.a.
0xb97879006d0065006e007400200072006500y.m.e.n.t. .r.e.
0xb9887100750069007200650064002e000039q.u.i.r.e.d....9
0xb99853006f00660074007700610072006500S.o.f.t.w.a.r.e.
0xb9a85c0043006c0061007300730065007300\.C.l.a.s.s.e.s.
0xb9b85c006d0073002d007300650074007400\.m.s.-.s.e.t.t.
0xb9c869006e0067007300015f53006f006600i.n.g.s.._S.o.f.
0xb9d8740077006100720065005c0043006c00t.w.a.r.e.\.C.l.
0xbcf142007900700061007300730020002d00B.y.p.a.s.s. .-.
0xbd0145006e00630020000115730079007300E.n.c. ...s.y.s.
0xbd11740065006d002e006200610074000029t.e.m...b.a.t..)
0xbd2140006500630068006f0020006f006600@.e.c.h.o. .o.f.
0xbd3166000a00730074006100720074002000f...s.t.a.r.t. .
0xbd412200220020002200000522000a00001b".". ."...".....
0xbd51570069006e00330032005f0050007200W.i.n.3.2._.P.r.
0xbd616f006300650073007300000d43007200o.c.e.s.s...C.r.
0xbd716500610074006500001743006f006d00e.a.t.e...C.o.m.
0xbd816d0061006e0064004c0069006e006500m.a.n.d.L.i.n.e.
0xbd91000f640065006c002e00620061007400..d.e.l...b.a.t.
0xbda10077760073007300610064006d006900.wv.s.s.a.d.m.i.
0xbdb16e002000640065006c00650074006500n. .d.e.l.e.t.e.
0xbdc1200073006800610064006f0077007300 .s.h.a.d.o.w.s.
0xbdd120002f0061006c006c0020002f007100 ./.a.l.l. ./.q.
0xbde175006900650074000a0077006d006900u.i.e.t...w.m.i.
0xbdf16300200073006800610064006f007700c. .s.h.a.d.o.w.
0xbe0163006f00700079002000640065006c00c.o.p.y. .d.e.l.
0xbe116500740065000a00000f43004f004f00e.t.e.....C.O.O.
0xbe214b00490045003a00003f63006f006e00K.I.E.:..?c.o.n.
0xbe3166006900670020006900380030003400f.i.g. .i.8.0.4.
0xbe41320070007200740020007300740061002.p.r.t. .s.t.a.
0xbe51720074003d0020006400690073006100r.t.=. .d.i.s.a.
0xbe6162006c0065006400001b730074006f00b.l.e.d...s.t.o.
0xbe7170002000690038003000340032007000p. .i.8.0.4.2.p.
0xbe8172007400001753007900730074006500r.t...S.y.s.t.e.
0xbe916d004400720069007600650000115300m.D.r.i.v.e...S.
0xbea14300520041005000450044003a000015C.R.A.P.E.D.:...
0xbeb148004500410052005400420045004100H.E.A.R.T.B.E.A.
0xbec154003a0000037c0000194b0045005900T.:...|...K.E.Y.
0xbed14c004f0047005f00420055004c004b00L.O.G._.B.U.L.K.
0xbee13a00001543004c00490050005f004200:...C.L.I.P._.B.
0xbef155004c004b003a0000053a002000000fU.L.K.:...:. ...
0xbf0163006d0064002e006500780065000023c.m.d...e.x.e..#
0xbf112f006300200073007900730074006500/.c. .s.y.s.t.e.
0xbf216d0069006e0066006f0020003e002000m.i.n.f.o. .>. .
0xbf312200001773007900730069006e006600"...s.y.s.i.n.f.
0xbf416f002e00740078007400001f2f006300o...t.x.t.../.c.
0xbf5120007400610073006b006c0069007300 .t.a.s.k.l.i.s.
0xbf61740020003e0020002200001974006100t. .>. ."...t.a.
0xbf7173006b006c006900730074002e007400s.k.l.i.s.t...t.
0xbf8178007400001b2f006300200077006800x.t.../.c. .w.h.
0xbf916f0061006d00690020003e0020002200o.a.m.i. .>. .".
0xbfa10015770068006f0061006d0069002e00..w.h.o.a.m.i...
0xbfb1740078007400001f2f00630020006e00t.x.t.../.c. .n.
0xbfc165007400200075007300650072002000e.t. .u.s.e.r. .
0xbfd13e002000220000176e00650074007500>. ."...n.e.t.u.
0xbfe17300650072002e007400780074000029s.e.r...t.x.t..)