2026-06-03_8ee262eed6ce9efe6be10ebd9fc41aa9_elex_gh0st-rat_nitol_scribble_virut_wannacry

General

Target
2026-06-03_8ee262eed6ce9efe6be10ebd9fc41aa9_elex_gh0st-rat_nitol_scribble_virut_wannacry
Size 65KB
Sample260603-eamylag19y
SHA256 df075186680e726046ff277a616984f2225f4087a2c3f2996116e5a9d4c4a63e
MD5 8ee262eed6ce9efe6be10ebd9fc41aa9
SHA1 147328815be8e3fa835927a5ea9aa7a5824b1a8b
SHA512 e6c49cbda3beb65706db5bd6c03704cf0e5c75047646a57627cfb29d6dd935b45b7fa5f42b5d0e8c4414b8b462094658a9c6b74bea40075aa18d49746e45e3b5
SSDEEP 768:I68uUCS77GhGLhLp6s1R6o9yHHojY9PkqV/Q8TBc6Wl8Rw2zlXOc/iCjXEmIoy/:I6BS7LL1Mdo9yHSmpxTBceRw2z1Ormu
TLSH
T12F53AF13DECA68F2C04604B035DFA7B6A9FF08FA160A21D7EBC0CDD62CB4654EA36555
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Custom signature

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-03_8ee262eed6ce9efe6be10ebd9fc41aa9_elex_gh0st-rat_nitol_scribble_virut_wannacry

File Explorer

2026-06-03_8ee262eed6ce9efe6be10ebd9fc41aa9_elex_gh0st-rat_nitol_scribble_virut_wannacry

.exe 65KB

2026-06-03_8ee262eed6ce9efe6be10ebd9fc41aa9_elex_gh0st-rat_nitol_scribble_virut_wannacry

IMPHASH 3bb7c80eb100b0ef5af9d6406a8cea4a
SHA256 df075186680e726046ff277a616984f2225f4087a2c3f2996116e5a9d4c4a63e
MD5 8ee262eed6ce9efe6be10ebd9fc41aa9
SHA1 147328815be8e3fa835927a5ea9aa7a5824b1a8b
SHA512 e6c49cbda3beb65706db5bd6c03704cf0e5c75047646a57627cfb29d6dd935b45b7fa5f42b5d0e8c4414b8b462094658a9c6b74bea40075aa18d49746e45e3b5
SSDEEP 768:I68uUCS77GhGLhLp6s1R6o9yHHojY9PkqV/Q8TBc6Wl8Rw2zlXOc/iCjXEmIoy/:I6BS7LL1Mdo9yHSmpxTBceRw2z1Ormu
TLSH
T12F53AF13DECA68F2C04604B035DFA7B6A9FF08FA160A21D7EBC0CDD62CB4654EA36555
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Windows executables referencing non-Windows User-Agents
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

25410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

shlwapi

StrStrA

wininet

InternetOpenUrlA InternetReadFile InternetCloseHandle

winmm

timeGetTime

msvcrt

_controlfp __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit fopen fclose fseek ftell fread ??2@YAPAXI@Z malloc sprintf rand _except_handler3 strncmp strstr strcspn strncpy atoi

kernel32

OpenMutexA GetStartupInfoA GetModuleFileNameA VirtualAlloc VirtualAllocEx VirtualProtectEx GetModuleHandleA WriteProcessMemory SetThreadContext ResumeThread GetThreadContext ReadProcessMemory VirtualQueryEx CreateProcessA TerminateProcess ExitThread RaiseException InterlockedExchange LocalAlloc GetLocaleInfoW GetComputerNameA GlobalMemoryStatusEx GetTickCount GetSystemDirectoryA CopyFileA CreateMutexA WaitForSingleObject lstrcpyA GetFileAttributesA GetFileSize GlobalAlloc ReadFile GlobalFree BeginUpdateResourceA UpdateResourceA EndUpdateResourceA EnumResourceNamesA CreateThread Sleep FreeLibrary GetProcAddress LoadLibraryA DeleteFileA ExitProcess WinExec lstrcatA ReleaseMutex GetLastError lstrlenA lstrcpynA CreateFileA CloseHandle MoveFileExA GetTempPathA WriteFile LockResource LoadResource SizeofResource FindResourceA

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-03_8ee262eed6ce9efe6be10ebd9fc41aa9_elex_gh0st-rat_nitol_scribble_virut_wannacry

shlwapi

wininet

winmm

msvcrt

kernel32

generic