Extracted

• • Target
    2026-07-05_b2f641209efa51dda327fb48bafd0986_elex_wannacry
  • Size 584KB
  • SHA256 f65a25e37c7abc88d641e13004c4e5523502b4568cfcf6713f4f50e34f23e770
  • MD5 b2f641209efa51dda327fb48bafd0986
  • SHA1 0b5439d135dc4d685e3fa346ac56dc89713b1a86
  • SHA512 2681fc2bf6854c7b688e28ab2253253a6d1087fceee5e3a84023bb14c5757fb856ebb1c87dcd5c33e6e619277aa9c50c9065e54208adf86d88e30a636d4bfbdf
  • SSDEEP 6144:VmPgvqJJWgEmEizgdS7Mm3o0wmjrdABecyw:VmUCJktEMm3WmmBiw
  • TLSH
    T197D4F21DEF2EBCE4F91E53BE3530482A3F519926B8BE586D61526626CC34343409BDCB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverygh0stratpersistenceratupxdownloaderredosdruloader

  • Family: Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Family: Redosdru

    Redosdru is a loader/downloader written in C++.

    loaderdownloaderredosdru

  • Gh0st RAT payload

  • Custom signature

    Detects Windows executables referencing non-Windows User-Agents

  • Custom signature

    UPX dump on OEP (original entry point)

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2