2026-10-02_ddec7ff1b1f272aca1f92218ead79334_destroyer_elex_glassworm_ngrbot_wannacry
Ransomware with keylogger and C2
.NET AES file encryptor with ransom demands.NET low-level hook keylogger with HTTP upload
SHA-256ed11a409cb9eec2e04a7a9b86acc9ed0c25e17c42f1cc4b66f2e10129513e3ac
Evidence
0x54d47263390070281300000a802b00000472rc9.p(.....+...r
0x54e471390070802c0000047e260000047287q9.p.,...~&...r.
0x54f4390070281300000a802d00000428a9009.p(.....-...(..
0x5504000a72a13900706f9d00000a802e0000..r.9.po........
0x55140428a900000a72c53900706f9d00000a.(....r.9.po....
0x5524802f0000047e6100000a803100000473./...~a....1...s
0x5534c700000a803200000472ff0100708033.....2...r...p.3
0x554400000472ff01007080340000042a0000...r...p.4...*..
0x555442534a4201000100000000000c000000BSJB............
0x556476342e302e3330333139000000000500v4.0.30319......
0x55746c0000009c1c0000237e0000081d0000l.......#~......
0x5584bc22000023537472696e677300000000."..#Strings....
0x5594c43f0000e839000023555300ac790000.?...9..#US..y..
0x55a4100000002347554944000000bc790000....#GUID....y..
0x55b4d80b000023426c6f6200000000000000....#Blob.......
0x55c402000001579f023e090a000000fa2533....W..>......%3
0x55d40016000001000000690000000f000000........i.......
0x55e47e000000a30000005f00000009000000~......._.......
0x55f4c7000000210000006300000001000000....!...c.......
0x560444000000120000000300000002000000D...............
0x56141c000000010000000100000005000000................
0x56240c0000001200000000000a0001000000................
0x563400000600600059000600670059000600....`.Y...g.Y...
0x5644a10395030600f305dc0506001e0b5900..............Y.
0x565406002b0b ..+.
0xa2990077006f007a002e006e0073002e0063.w.o.z...n.s...c
0xa2a9006c006f007500640066006c00610072.l.o.u.d.f.l.a.r
0xa2b90065002e0063006f006d000017410070.e...c.o.m...A.p
0xa2c90070006c00690063006100740069006f.p.l.i.c.a.t.i.o
0xa2d9006e00001f5300650072007600690063.n...S.e.r.v.i.c
0xa2e900650020007300740061007200740065.e. .s.t.a.r.t.e
0xa2f9006400005b53004f0046005400570041.d..[S.O.F.T.W.A
0xa30900520045005c004d006900630072006f.R.E.\.M.i.c.r.o
0xa3190073006f00660074005c00570069006e.s.o.f.t.\.W.i.n
0xa3290064006f00770073005c004300750072.d.o.w.s.\.C.u.r
0xa33900720065006e00740056006500720073.r.e.n.t.V.e.r.s
0xa3490069006f006e005c00520075006e0000.i.o.n.\.R.u.n..
0xa35913530079007300550070006400610074.S.y.s.U.p.d.a.t
0xa369006500001b5300790073005500700064.e...S.y.s.U.p.d
0xa379006100740065002e0065007800650000.a.t.e...e.x.e..
0xa389117300630068007400610073006b0073.s.c.h.t.a.s.k.s
0xa3990000432f006300720065006100740065..C/.c.r.e.a.t.e
0xa3a90020002f0074006e0020002200530079. ./.t.n. .".S.y
0xa3b900730055007000640061007400650054.s.U.p.d.a.t.e.T
0xa3c900610073006b00220020002f00740072.a.s.k.". ./.t.r
0xa3d900200022000021220020002f00730063. ."..!". ./.s.c
0xa3e90020006f006e006c006f0067006f006e. .o.n.l.o.g.o.n
0xa3f90020002f00660000472f006300720065. ./.f..G/.c.r.e
0xa4090061007400650020002f0074006e0020.a.t.e. ./.t.n.
0xa41900220053007900730055007000640061.".S.y.s.U.p.d.a
0xa42900740065004200610063006b00750070.t.e.B.a.c.k.u.p
0xa43900220020002f00740072002000220000.". ./.t.r. ."..
0xa4492d220020002f007300630020006d0069-". ./.s.c. .m.i
0xa459006e0075007400650020002f006d006f.n.u.t.e. ./.m.o
0xa4690020003300300020002f006600000320. .3.0. ./.f...
0xa4790000155b00480048003a006d006d003a...[.H.H.:.m.m.:
0xa48900730073005d00000520002800000529.s.s.]... .(...)
0xa49900200000050d000a00000f4b00450059. .........K.E.Y
0xa4a9004c004f0047003a0000035b0000055d.L.O.G.:...[...]
0xa4b900200000030a00000b43004c00490050. .......C.L.I.P
0xa4c9003a0000097300630072005f00001f79.:...s.c.r._...y
0xa4d9007900790079004d004d00640064005f.y.y.y.M.M.d.d._
0xa4e900480048006d006d007300730000092e.H.H.m.m.s.s....
0xa4f9006a0070006700000f53004300520045.j.p.g...S.C.R.E
0xa5090045004e003a00001344006f0077006e.E.N.:...D.o.w.n
0xa519006c006f0061006400730000092e0074.l.o.a.d.s.....t
0xa529007800740000092e0064006f00630000.x.t.....d.o.c..
0xa5390b2e0064006f006300780000092e0070...d.o.c.x.....p
0xa549006400660000092e0078006c00730000.d.f.....x.l.s..
0xa5590b2e0078006c007300780000092e0070...x.l.s.x.....p
0xa569006e00670000092e007a006900700000.n.g.....z.i.p..
0xa579032a00000f2e00730074006f006c0065.*.....s.t.o.l.e
0xa589006e00000b460049004c0045003a0000.n...F.I.L.E.:..
0xab0d2d002d00200042006100730065003600-.-. .B.a.s.e.6.
0xab1d3400200062006f0074006e00650074004. .b.o.t.n.e.t.
0xab2d3a0020000180ab0d000a002d002d0020:. ........-.-.
0xab3d00540068006900730020005000440046.T.h.i.s. .P.D.F
0xab4d00200063006f006e007400610069006e. .c.o.n.t.a.i.n
0xab5d0073002000610020006d0061006c0077.s. .a. .m.a.l.w
0xab6d006100720065002e00200050006c0065.a.r.e... .P.l.e
0xab7d006100730065002000720075006e0020.a.s.e. .r.u.n.
0xab8d00740068006500200061007400740061.t.h.e. .a.t.t.a
0xab9d00630068006500640020006500780065.c.h.e.d. .e.x.e
0xabad00630075007400610062006c00650020.c.u.t.a.b.l.e.
0xabbd0074006f002000760069006500770020.t.o. .v.i.e.w.
0xabcd0063006f006e00740065006e0074002e.c.o.n.t.e.n.t..
0xabdd000180810d000a005300650074002000........S.e.t. .
0xabed6f005700530020003d00200057005300o.W.S. .=. .W.S.
0xabfd630072006900700074002e0043007200c.r.i.p.t...C.r.
0xac0d65006100740065004f0062006a006500e.a.t.e.O.b.j.e.
0xac1d63007400280022005700530063007200c.t.(.".W.S.c.r.
0xac2d6900700074002e005300680065006c00i.p.t...S.h.e.l.
0xac3d6c00220029000d000a0073004c006900l.".).....s.L.i.
0xac4d6e006b00460069006c00650020003d00n.k.F.i.l.e. .=.
0xac5d20002200002d49006d0070006f007200 ."..-I.m.p.o.r.
0xac6d740061006e0074005f0044006f006300t.a.n.t._.D.o.c.
0xac7d75006d0065006e0074002e006c006e00u.m.e.n.t...l.n.
0xac8d6b0000808522000d000a005300650074k....".....S.e.t
0xac9d0020006f004c0069006e006b0020003d. .o.L.i.n.k. .=
0xacad0020006f00570053002e004300720065. .o.W.S...C.r.e
0xacbd00610074006500530068006f00720074.a.t.e.S.h.o.r.t
0xaccd00630075007400280073004c0069006e.c.u.t.(.s.L.i.n
0xacdd006b00460069006c00650029000d000a.k.F.i.l.e.)....
0xaced006f004c0069006e006b002e00540061.o.L.i.n.k...T.a
0xacfd00720067006500740050006100740068.r.g.e.t.P.a.t.h
0xad0d0020003d0020002200001b22000d000a. .=. ."..."....
0xad1d006f004c0069006e006b002e00530061.o.L.i.n.k...S.a
0xad2d007600650000176d0061006b0065006c.v.e...m.a.k.e.l
0xad3d006e006b002e00760062007300001777.n.k...v.b.s...w
0xad4d007300630072006900700074002e0065.s.c.r.i.p.t...e
0xad5d0078006500002f530079007300740065.x.e../S.y.s.t.e
0xad6d006d0056006f006c0075006d00650049.m.V.o.l.u.m.e.I
0xad7d006e0066006f0072006d006100740069.n.f.o.r.m.a.t.i
0xad8d006f006e00000964006f0063005f0000.o.n...d.o.c._..
0xad9d2742006f0074006e0065007400200050'B.o.t.n.e.t. .P
0xadad0044004600200063006f006e00740065.D.F. .c.o.n.t.e
0xadbd006e0074002000001350004400460042.n.t. ...P.D.F.B
0xadcd006f0074006e00650074000039500044.o.t.n.e.t..9P.D
0xaddd00460042006f0074006e00650074005c.F.B.o.t.n.e.t.\
0xaded007300680065006c006c005c006f0070.s.h.e.l.l.\.o.p
0xadfd0065006e005c0063006f006d006d0061.e.n.\.c.o.m.m.a
0xb6d078006500000d77007300630073007600x.e...w.s.c.s.v.
0xb6e06300002b530065006300750072006900c..+S.e.c.u.r.i.
0xb6f0740079004800650061006c0074006800t.y.H.e.a.l.t.h.
0xb70053006500720076006900630065000013S.e.r.v.i.c.e...
0xb710570069006e0044006500660065006e00W.i.n.D.e.f.e.n.
0xb7206400000f4d0073004d00700053007600d...M.s.M.p.S.v.
0xb7306300000573006300000b730074006f00c...s.c...s.t.o.
0xb74070002000000f63006f006e0066006900p. ...c.o.n.f.i.
0xb75067002000002120007300740061007200g. ..! .s.t.a.r.
0xb76074003d00200064006900730061006200t.=. .d.i.s.a.b.
0xb7706c0065006400001b6b00610073007000l.e.d...k.a.s.p.
0xb7806500720073006b0079002e0063006f00e.r.s.k.y...c.o.
0xb7906d0000156d0063006100660065006500m...m.c.a.f.e.e.
0xb7a02e0063006f006d000019730079006d00..c.o.m...s.y.m.
0xb7b061006e007400650063002e0063006f00a.n.t.e.c...c.o.
0xb7c06d000013610076006100730074002e00m...a.v.a.s.t...
0xb7d063006f006d00001f6200690074006400c.o.m...b.i.t.d.
0xb7e06500660065006e006400650072002e00e.f.e.n.d.e.r...
0xb7f063006f006d0000116500730065007400c.o.m...e.s.e.t.
0xb8002e0063006f006d00001d740072006500..c.o.m...t.r.e.
0xb8106e0064006d006900630072006f002e00n.d.m.i.c.r.o...
0xb82063006f006d0000216d0061006c007700c.o.m..!m.a.l.w.
0xb83061007200650062007900740065007300a.r.e.b.y.t.e.s.
0xb8402e0063006f006d00001d760069007200..c.o.m...v.i.r.
0xb8507500730074006f00740061006c002e00u.s.t.o.t.a.l...
0xb86063006f006d0000153100320037002e00c.o.m...1.2.7...
0xb87030002e0030002e0031002000001b57000...0...1. ...W.
0xb88061006e006e0061004300720079004d00a.n.n.a.C.r.y.M.
0xb890750074006500780000194c006f006300u.t.e.x...L.o.c.
0xb8a06b004200690074004d00750074006500k.B.i.t.M.u.t.e.
0xb8b078000021480069006400640065006e00x..!H.i.d.d.e.n.
0xb8c0540065006100720073004d0075007400T.e.a.r.s.M.u.t.
0xb8d06500780000135200790075006b004d00e.x...R.y.u.k.M.
0xb8e075007400650078000015520045007600u.t.e.x...R.E.v.
0xb8f069006c004d007500740065007800000fi.l.M.u.t.e.x...
0xb90047006c006f00620061006c005c000029G.l.o.b.a.l.\..)
0xb910520061006e0073006f006d0077006100R.a.n.s.o.m.w.a.
0xb92072006500530069006d0075006c006100r.e.S.i.m.u.l.a.
0xb930740069006f006e000045460069006c00t.i.o.n..EF.i.l.
0xb94065007300200065006e00630072007900e.s. .e.n.c.r.y.
0xb95070007400650064002e00200050006100p.t.e.d... .P.a.
0xb96079006d0065006e007400200072006500y.m.e.n.t. .r.e.
0xb9707100750069007200650064002e000039q.u.i.r.e.d....9
0xb98053006f00660074007700610072006500S.o.f.t.w.a.r.e.
0xb9905c0043006c0061007300730065007300\.C.l.a.s.s.e.s.
0xb9a05c006d0073002d007300650074007400\.m.s.-.s.e.t.t.
0xb9b069006e0067007300015f53006f006600i.n.g.s.._S.o.f.
0xb9c0740077006100720065005c0043006c00t.w.a.r.e.\.C.l.
0xbcd942007900700061007300730020002d00B.y.p.a.s.s. .-.
0xbce945006e00630020000115730079007300E.n.c. ...s.y.s.
0xbcf9740065006d002e006200610074000029t.e.m...b.a.t..)
0xbd0940006500630068006f0020006f006600@.e.c.h.o. .o.f.
0xbd1966000a00730074006100720074002000f...s.t.a.r.t. .
0xbd292200220020002200000522000a00001b".". ."...".....
0xbd39570069006e00330032005f0050007200W.i.n.3.2._.P.r.
0xbd496f006300650073007300000d43007200o.c.e.s.s...C.r.
0xbd596500610074006500001743006f006d00e.a.t.e...C.o.m.
0xbd696d0061006e0064004c0069006e006500m.a.n.d.L.i.n.e.
0xbd79000f640065006c002e00620061007400..d.e.l...b.a.t.
0xbd890077760073007300610064006d006900.wv.s.s.a.d.m.i.
0xbd996e002000640065006c00650074006500n. .d.e.l.e.t.e.
0xbda9200073006800610064006f0077007300 .s.h.a.d.o.w.s.
0xbdb920002f0061006c006c0020002f007100 ./.a.l.l. ./.q.
0xbdc975006900650074000a0077006d006900u.i.e.t...w.m.i.
0xbdd96300200073006800610064006f007700c. .s.h.a.d.o.w.
0xbde963006f00700079002000640065006c00c.o.p.y. .d.e.l.
0xbdf96500740065000a00000f43004f004f00e.t.e.....C.O.O.
0xbe094b00490045003a00003f63006f006e00K.I.E.:..?c.o.n.
0xbe1966006900670020006900380030003400f.i.g. .i.8.0.4.
0xbe29320070007200740020007300740061002.p.r.t. .s.t.a.
0xbe39720074003d0020006400690073006100r.t.=. .d.i.s.a.
0xbe4962006c0065006400001b730074006f00b.l.e.d...s.t.o.
0xbe5970002000690038003000340032007000p. .i.8.0.4.2.p.
0xbe6972007400001753007900730074006500r.t...S.y.s.t.e.
0xbe796d004400720069007600650000115300m.D.r.i.v.e...S.
0xbe894300520041005000450044003a000015C.R.A.P.E.D.:...
0xbe9948004500410052005400420045004100H.E.A.R.T.B.E.A.
0xbea954003a0000037c0000194b0045005900T.:...|...K.E.Y.
0xbeb94c004f0047005f00420055004c004b00L.O.G._.B.U.L.K.
0xbec93a00001543004c00490050005f004200:...C.L.I.P._.B.
0xbed955004c004b003a0000053a002000000fU.L.K.:...:. ...
0xbee963006d0064002e006500780065000023c.m.d...e.x.e..#
0xbef92f006300200073007900730074006500/.c. .s.y.s.t.e.
0xbf096d0069006e0066006f0020003e002000m.i.n.f.o. .>. .
0xbf192200001773007900730069006e006600"...s.y.s.i.n.f.
0xbf296f002e00740078007400001f2f006300o...t.x.t.../.c.
0xbf3920007400610073006b006c0069007300 .t.a.s.k.l.i.s.
0xbf49740020003e0020002200001974006100t. .>. ."...t.a.
0xbf5973006b006c006900730074002e007400s.k.l.i.s.t...t.
0xbf6978007400001b2f006300200077006800x.t.../.c. .w.h.
0xbf796f0061006d00690020003e0020002200o.a.m.i. .>. .".
0xbf890015770068006f0061006d0069002e00..w.h.o.a.m.i...
0xbf99740078007400001f2f00630020006e00t.x.t.../.c. .n.
0xbfa965007400200075007300650072002000e.t. .u.s.e.r. .
0xbfb93e002000220000176e00650074007500>. ."...n.e.t.u.
0xbfc97300650072002e007400780074000029s.e.r...t.x.t..)