2026-09-27_a8e8c7933381761436207a74a7418a6d_elex_glassworm_wannacry
WannaCry ransomware indicators present
Elex QQ recovery tampering stealerRunServices persistence uses browser and input process names
SHA-256af90f1d5230219ff7dc6a4a02b187e6bc2edcdc813d0ba426ec37bae7b00ca1a
Evidence
⋯7 more rows
0xaff000000000000000000000000000000000................
0xb000961b6f769904717625bc6f760dbc6f76..ov..qv%.ov..ov
0xb010711b6f76d4be6f764e196f7600000000q.ov..ovN.ov....
0xb020b68bf07554fef1759729f1755112f175...uT..u.).uQ..u
0xb03076eff0752b3af07576f1f075b705f175v..u+:.uv..u...u
0xb040af44f0750f41ef751cb4ef757ad7ef75.D.u.A.u...uz..u
0xb0507410f17595e6f4756b08f075e0e5ef75t..u...uk..u...u
0xb060f4c5f07512a7ef75cc29f1759689f275...u...u.).u...u
0xb070d728f175f01dec75918bf27566eff075.(.u...u...uf..u
0xb08062ccf075f619f175e919f1759b50f075b..u...u...u.P.u
0xb090230df175e473f0753718f1756428f175#..u.s.u7..ud(.u
0xb0a03912f1751f2af17500000000f351f16d9..u.*.u.....Q.m
0xb0b07ce4ef6d2aeaed6d0675ee6d094bee6d|..m*..m.u.m.K.m
⋯12 more rows
⋯3 more rows
0xb2485f55bf752929c2758945bc754cedbb75_U.u)).u.E.uL..u
0xb25806f6bb75c8f3bb75ea22bc75aedbba75...u...u.".u...u
0xb268c4b2bb75bd1abb750bcabb759ed4bb75...u...u...u...u
0xb27838dbba757805bb759534bc7554d3bb758..ux..u.4.uT..u
0xb28808f7ba75e0dbba75855fbc75ebdbba75...u...u._.u...u
0xb2984adeba7557f7ba7570c0ba75a908bb75J..uW..up..u...u
0xb2a843b4ba755a9eba75793dbb75ac76bb75C..uZ..uy=.u.v.u
0xb2b8e1e1ba7500000000a59bc07600000000...u.......v....
0xb2c818a85c7684715c767a145d7681355d76..\v.q\vz.]v.5]v
0xb2d89b3b5f7656d65c76b1e65c7639695d76.;_vV.\v..\v9i]v
0xb2e85d565d7656775d76a9e75c763e3c5d76]V]vVw]v..\v><]v
0xb2f8b37a5d76976e5f7621c95c7671ea6176.z]v.n_v!.\vq.av
0xb308d7635c76d5775d7628cc5c76da4f5d76.c\v.w]v(.\v.O]v
0xb3182ea75c76e32f5d76bdd95c7600000000..\v./]v..\v....
0xb328fc006a77300b6577a4e2627702cc6277..jw0.ew..bw..bw
0xb338a5156a77fa9a62773a0463771c7e6377..jw..bw:.cw.~cw
0xb3487ec862774f056377000000003371b775~.bwO.cw....3q.u
0xb358df47b675c8c4b675be48b6753432b675.G.u...u.H.u42.u
0xb368ab2fb675ed3bb675003fb675f945b675./.u.;.u.?.u.E.u
0xb3786136b675fbc0b675772fb67500000000a6.u...uw/.u....
0xb3880010400090b340001101000000000000..@...@.........
0xb39846e1000046e100000c000000e0a04000F...F.........@.
⋯12 more rows
⋯7 more rows
0xbf800000467265654c696272617279000000..FreeLibrary...
0xbf905465726d696e61746550726f63657373TerminateProcess
0xbfa00000000047657443757272656e745072....GetCurrentPr
⋯8 more rows
0xc030656174654469726563746f7279410000eateDirectoryA..
0xc040000057696e4578656300000053657446..WinExec...SetF
0xc050696c6554696d6500000053657446696cileTime...SetFil
0xc06065417474726962757465734100000000eAttributesA....
⋯8 more rows
⋯3 more rows
0xd04064000000c3bdcce5b2a5b7c5c6f70000d...............
0xd050687474703a2f2f7777772e333732312ehttp://www.3721.
0xd060636f6d2f61646a75737474696d652e68com/adjusttime.h
0xd070746d00004d6f7a696c6c612f342e3020tm..Mozilla/4.0
0xd08028636f6d70617469626c653b204d5349(compatible; MSI
0xd0904520362e303b2057696e646f7773204eE 6.0; Windows N
0xd0a05420352e31290000436f6e74656e742dT 5.1)..Content-
0xd0b0547970653a206170706c69636174696fType: applicatio
0xd0c06e2f782d7777772d666f726d2d75726cn/x-www-form-url
0xd0d0656e636f6465640047455400504f5354encoded.GET.POST
0xd0e000000000485454502f312e3100000000....HTTP/1.1....
⋯13 more rows
0xd1c0645f2564000000002573256400000000d_%d....%s%d....
0xd1d0535441540d0a0000504153532025730dSTAT....PASS %s.
0xd1e00a000000555345522025730d0a000000....USER %s.....
0xd1f02b4f4b00534f4654574152455c436c61+OK.SOFTWARE\Cla
0xd200737365735c4d53697079000074657874sses\MSipy..text
0xd2102f706c61696e00002e0a000025735c7e/plain......%s\~
0xd2207e7e3038642530326425642e746d7000~~08d%02d%d.tmp.
0xd23025735c25730000002e65786500000000%s\%s....exe....
0xd2405f6578652e00000066696c656e616d65_exe....filename
0xd2503d220000436f6e74656e742d54797065="..Content-Type
0xd2603a200000436f6e74656e742d5472616e: ..Content-Tran
0xd270736665722d456e636f64696e673a2000sfer-Encoding: .
⋯9 more rows
⋯7 more rows
0xe2182047656e697573203231737400000000 Genius 21st....
0xe228534f4654574152455c476f6c64656e53SOFTWARE\GoldenS
0xe2386f66745c5265636f766572792047656eoft\Recovery Gen
0xe24869757300534f4654574152455c597561ius.SOFTWARE\Yua
0xe2586e5a68695c5265636f76657279204765nZhi\Recovery Ge
0xe2686e6975732032317374000000534f4654nius 21st...SOFT
0xe278574152455c5975616e5a68695c526563WARE\YuanZhi\Rec
0xe2886f766572792047656e69757300000000overy Genius....
0xe298416e696d61746557696e646f77000000AnimateWindow...
⋯15 more rows