2026-09-28_76a821e15cfffd83221ed0883c9eff65_elex_wannacry
WannaCry ransomware with credential theft
Native binary stream-copies itself through autorun drivesProtected Storage passwords sent by URL-encoded HTTP POST
SHA-256fc3ef63f3e24ac49045bef1c6c927dcc75144b87b97c447a24e3bdfb1190c0e5
Evidence
⋯5 more rows
0x3f000000000000000000000000000000000................
0x40000000000000000000000000000000000................
0x41000000000000000000000000000000000................
0x42000000000000000000000000000000000................
⋯35 more rows
⋯7 more rows
0x25ff0bc001417058f67405ea0dddc25773d28......g@^...%w=(
0x26000190ef59ce9e9361d212d1a1dd21bcb77......6.!-.....w
0x2601083faf5fdb2f33c29dc0ab7bd00cb179c......<)........
0x2602093e9240a45fd83009420cd64961976f9..$.E.... .d..v.
0x26030176582400b7c28c54808ca2482f90994.e.@.|(.H..$....
0x2604037440528617597eb44018634fcf2289b7D.(au..D..4..(.
0x2605079e2dc2de30a00db29fb010e88217526y..-....)....!u&
0x2606089666fc081d8be031a37f1fa3025156f.fo......7..0%.o
0x26070f9abc69dd40b111da681fb5a29e16128...........Z).a(
0x260802bc5d1c78e38dca415ad31ed01f8894d+....8....1....M
0x26090c75bc206ed8d5e582d7e60be61e1f901.[....^X-~`.a...
0x260a0250719dd069cb71d819135dd336ac215%.........5.3j..
0x260b05f5c39fa35016b6096da75018279f951_\9.5.k`..u..y.Q
0x260c019438b81ca76fa195808e905ca0c9c47.C...v..X......G
0x260d085cdfa0580451b2164fe7790d9b5050d.....E.!d.w.....
0x260e0081535e59d3db3b50237e1338119051a..5..=...7.3....
0x260f087444d0a5612caff818808216c9f19c6.DM.V......!l...
0x26100bfb698c46f237112090b30e8dd9e0381....o#q...0.....
0x261105d49ce6f061e7da68796a834cd2ad109]I.o..}....4.*..
0x2612060d8011909e31bae454719eedb8483c3`.......EG......
0x261300d1d581c151f0b8c22fe4de62611ee0c..X.....".M.&...
0x2615019f70819f12d34214a2549a5826ccb25.....-4!J%I..l.%
0x26160c30018eebb0ab16dc203cc700215c8c6.......m...p....
0x26170245a07e435d45935662e663701b85935$Z..5.Y5f.f7..Y5
0x261803d9ace94dd35dc4e7935d864ccb2c5b2=....5.Ny5.d....
0x26190593dc18ba889dc2e09bc37e1c3fc3042Y=........7...0B
⋯7 more rows
⋯4 more rows
0x26a6c43000000516776446b6e67437676706bC...QgvDkngCvvpk
0x26a7c60777667714300005067655167765463`wvgqC..PgeQgvTc
0x26a8c6e7767477a4300005067654d72676c49nwgGzC..PgeMrglI
0x26a9c677b4300506765416e6d716749677b00g{C.PgeAnmqgIg{.
0x26aac6a767672382d2d6077606e6b696b6366jvvr8--`w`nkikcf
0x26abc6f6b6c6b71767063766d702c616d6f2doklkqvpcvmp,amo-
0x26acc000000006a767672382d2d6077606e6b....jvvr8--`w`nk
0x26adc696b6f636c636567702c616d6f2d0000ikoclcegp,amo-..
0x26aec6f6c645f6c6f6164000000005d5d5d5dold_load....]]]]
0x26afc5d5d5d5d005f5f5f5f5f5f5f5f5f5f5f]]]].___________
0x26b0c5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f5f________________
0x26b1c5f5f5f5f5f0000006065776e6c6d2d66_____...`ewnlm-f
0x26b2c7b66000077746b6b68772a617c610000{f..wtkkhw*a|a..
0x26b3c706266252538727a7a000000633a5c73pbf%%8rzz...c:\s
⋯16 more rows
0x26c4c6f68626971755a457374746368725063ohbiquZEsttchrPc
0x26c5c74756f69685a5473685a0000496d6167tuoihZTshZ..Imag
0x26c6c6550617468000000515b5156474f5e41ePath...Q[QVGO^A
0x26c7c777070676c76416d6c76706d6e516776wppglvAmlvpmnQgv
0x26c8c5e516770746b6167715e51616a676677^Qgptkagq^Qajgfw
0x26c9c6e6700002225312220252a0020222531ng.."%1" %*. "%1
0x26cac2220252a000000005a637e63606f6a63" %*....Zc~c`ojc
⋯7 more rows
⋯3 more rows
0x26e70676c616d666766002f0000002f000000glamfgf./.../...
0x26e80504f535420257320485454502f312e31POST %s HTTP/1.1
0x26e900d0a486f73743a2025730d0a436f6e74..Host: %s..Cont
0x26ea0656e742d547970653a206170706c6963ent-Type: applic
0x26eb06174696f6e2f782d7777772d666f726dation/x-www-form
0x26ec02d75726c656e636f6465640d0a436f6e-urlencoded..Con
0x26ed074656e742d6c656e6774683a2025640dtent-length: %d.
0x26ee00a0d0a25730000000a000000233a5c00...%s.......#:\.
0x26ef06377766d70776c2c677a67006377766dcwvmpwl,gzg.cwvm
0x26f0070776c2c6b6c64007700000059637776pwl,kld.w...Ycwv
0x26f106d70776c5f0000000d0a0000516a676empwl_.......Qjgn
0x26f206e477a67617776673f6377766d70776cnGzgawvg?cwvmpwl
0x26f302c677a67000000007067652266676e67,gzg....pge"fgng
0x26f40766722204a494e4f5e514d4456554350vg" JINO^QMDVUCP
0x26f50475e4f6b61706d716d64765e556b6c66G^Okapmqmdv^Uklf
0x26f606d75715e41777070676c76546770716bmuq^AwppglvTgpqk
0x26f706d6c5e477a726e6d7067705e40706d75ml^Gzrnmpgp^@pmu
0x26f80716770224a676e726770224d60686761qgp"Jgnrgp"M`hga
0x26f90767120222d6400004578706c6f726572vq "-d..Explorer
0x26fa02e657865000000005368656c6c000000.exe....Shell...
0x26fb0514d4456554350475e4f6b61706d716dQMDVUCPG^Okapmqm
0x26fc064765e556b6c666d7571224c565e4177dv^Uklfmuq"LV^Aw
0x26fd07070676c76546770716b6d6c5e556b6cppglvTgpqkml^Ukl
0x26fe06e6d656d6c5e00006c6f676f6e75692enmeml^..logonui.
0x26ff0657865005549486f73740000514d4456exe.UIHost..QMDV
⋯3 more rows
0x270306c5e00005c75736572696e69742e6578l^..\userinit.ex
0x27040652c000055736572496e697400000000e,..UserInit....
0x27050514d4456554350475e4f6b61706d716dQMDVUCPG^Okapmqm
0x2706064765e556b6c666d7571224c565e4177dv^Uklfmuq"LV^Aw
0x270707070676c76546770716b6d6c5e556b6cppglvTgpqkml^Ukl
0x270806e6d656d6c5e00007067652266676e67nmeml^..pge"fgng
0x27090766722204a494e4f5e514d4456554350vg" JINO^QMDVUCP
0x270a0475e4f6b61706d716d64765e556b6c66G^Okapmqmdv^Uklf
0x270b06d75715e41777070676c76546770716bmuq^AwppglvTgpqk
0x270c06d6c5e50776c20222d64000070676522ml^Pwl "-d..pge"
0x270d066676e67766722204a4941575e514d44fgngvg" JIAW^QMD
0x270e056554350475e4f6b61706d716d64765eVUCPG^Okapmqmdv^
0x270f0556b6c666d75715e41777070676c7654Uklfmuq^AwppglvT
0x271006770716b6d6c5e50776c20222d640000gpqkml^Pwl "-d..
0x271107067652266676e67766722204a494e4fpge"fgngvg" JINO
0x271205e514d4456554350475e4f6b61706d71^QMDVUCPG^Okapmq
0x271306d64765e556b6c666d75715e41777070mdv^Uklfmuq^Awpp
⋯10 more rows
0x2c48d7400016c737472636d704100016c7374t..lstrcmpA..lst
0x2c49d726370796e4100014765744c6f676963rcpynA..GetLogic
0x2c4ad616c4472697665537472696e67734100alDriveStringsA.
0x2c4bd01476574447269766554797065410001.GetDriveTypeA..
0x2c4cd6c7374726c656e4100016c7374726361lstrlenA..lstrca
⋯8 more rows
0x2c55d63657373410001436c6f736548616e64cessA..CloseHand
0x2c56d6c65000150726f6365737333324e6578le..Process32Nex
0x2c57d74000150726f63657373333246697273t..Process32Firs
0x2c58d740001437265617465546f6f6c68656ct..CreateToolhel
0x2c59d703332536e617073686f740001437265p32Snapshot..Cre
0x2c5ad6174655468726561640001476c6f6261ateThread..Globa
⋯11 more rows
0x2c66d66000161746f69000166636c6f736500f..atoi..fclose.
0x2c67d016674656c6c0001667365656b000166.ftell..fseek..f
0x2c68d6f70656e0001746f757070657200015fopen..toupper.._
⋯5 more rows