General
- Target 2026-07-02_cc6ae7e0d6c5962d095af2b817582d19_agent-tesla_elex_glassworm_remcos_swisyn_wannacry
- Size 4.3MB
- Sample260702-ryznhsf14z
- SHA256 72f438910d20eff832e67854d8892c1be4b8bcdb5932b3e46e1b97bad069dae6
- MD5 cc6ae7e0d6c5962d095af2b817582d19
- SHA1 d3fd30e6e540c8201208c8bae8fdfd131921b48f
- SHA512 dc87d82282cc065305315d40af800cec670e005c98d88edf8d9fe26fcc43f890ff857697fe7bb428c1528bec33fed024f242bf3df46af8c43eac1e1c259837a7
- SSDEEP 49152:3XwKFYd/FFRRRcFpfwKDNhjWlqIJKvcFM/wQ76Zjr3/X+pfYkw0rC2A3H4puTjgY:Hw5dSpfNjWlex/rKUjFNxvLWBv
- TLSH T1CA265A0427E84626F1BE77F9D071542087B4EC46AA62EB0E29B4B5A91C73B43CD4D36F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-02_cc6ae7e0d6c5962d095af2b817582d19_agent-tesla_elex_glassworm_remcos_swisyn_wannacry.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-02_cc6ae7e0d6c5962d095af2b817582d19_agent-tesla_elex_glassworm_remcos_swisyn_wannacry.exe
Resource
win11ltsc2024-20260629-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-02_cc6ae7e0d6c5962d095af2b817582d19_agent-tesla_elex_glassworm_remcos_swisyn_wannacry
- Size 4.3MB
- SHA256 72f438910d20eff832e67854d8892c1be4b8bcdb5932b3e46e1b97bad069dae6
- MD5 cc6ae7e0d6c5962d095af2b817582d19
- SHA1 d3fd30e6e540c8201208c8bae8fdfd131921b48f
- SHA512 dc87d82282cc065305315d40af800cec670e005c98d88edf8d9fe26fcc43f890ff857697fe7bb428c1528bec33fed024f242bf3df46af8c43eac1e1c259837a7
- SSDEEP 49152:3XwKFYd/FFRRRcFpfwKDNhjWlqIJKvcFM/wQ76Zjr3/X+pfYkw0rC2A3H4puTjgY:Hw5dSpfNjWlex/rKUjFNxvLWBv
- TLSH T1CA265A0427E84626F1BE77F9D071542087B4EC46AA62EB0E29B4B5A91C73B43CD4D36F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies visibility of hidden/system files in Explorer
-
Detects encrypted or obfuscated .NET executables
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory