General
- Target 2026-07-01_437588f6f2ff077937298232d62a04a5_elex_gh0st-rat_nitol_scribble_virut_wannacry
- Size 39KB
- Sample260701-n83ldafv5s
- SHA256 c823d760d38c16db0034cdbf152011912b91715a5a35a264c1bf70da39f873d8
- MD5 437588f6f2ff077937298232d62a04a5
- SHA1 83737511d0f2e56f06389b1e80664c54a01161fd
- SHA512 9b7a1aed777e423a11314ce71b02b2ce2095afaf21df97f6afd830db136866874239655cc6ba76702e18012a15ce676176cf6bc4d564d3729fbf968d4e008b87
- SSDEEP 768:1amUkTe2uVf8VPZUpRwqKYxPRDUVojyH6ojY9Puu+s9:1a9iexVfev6aojyHDmWF+
- TLSH T15B035B47ED8254E2F152007C386AA7FA69EB4C71472FB19BDF80DC8118B1618F57A3D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-01_437588f6f2ff077937298232d62a04a5_elex_gh0st-rat_nitol_scribble_virut_wannacry.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-01_437588f6f2ff077937298232d62a04a5_elex_gh0st-rat_nitol_scribble_virut_wannacry.exe
Resource
win11ltsc2024-20260629-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-01_437588f6f2ff077937298232d62a04a5_elex_gh0st-rat_nitol_scribble_virut_wannacry
- Size 39KB
- SHA256 c823d760d38c16db0034cdbf152011912b91715a5a35a264c1bf70da39f873d8
- MD5 437588f6f2ff077937298232d62a04a5
- SHA1 83737511d0f2e56f06389b1e80664c54a01161fd
- SHA512 9b7a1aed777e423a11314ce71b02b2ce2095afaf21df97f6afd830db136866874239655cc6ba76702e18012a15ce676176cf6bc4d564d3729fbf968d4e008b87
- SSDEEP 768:1amUkTe2uVf8VPZUpRwqKYxPRDUVojyH6ojY9Puu+s9:1a9iexVfev6aojyHDmWF+
- TLSH T15B035B47ED8254E2F152007C386AA7FA69EB4C71472FB19BDF80DC8118B1618F57A3D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects Windows executables referencing non-Windows User-Agents
-
Executes dropped EXE
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext