General
- Target 2026-07-05_3c8ac85e1461768e0db87eae606e76d3_elex_gh0st-rat_nitol_scribble_virut_wannacry
- Size 64KB
- Sample260705-tpy2qshw3l
- SHA256 bac86178c4811a3b74d52bc0355c19cf0362a9af4443b4679fd06b693cac81fa
- MD5 3c8ac85e1461768e0db87eae606e76d3
- SHA1 d91257587b596e6fc93f3785d443eca235a49c55
- SHA512 96060f9beecdd499d553a3e194fd6cf9c31a07b4a11c437bf7c1e00477673a93e66da1b6d2c6d4faa17e7db4f6be7d65fceb142af9b1063a204e7d4fd27daa99
- SSDEEP 1536:Ma9iexVfevkrojyHDml5SweIbeWfpr1a+ARc:r9/jf6kuyHDGSrjWfza+AR
- TLSH T10353BF57ED8754F2E16210BC786AB3B559EF0C72462F719BDF90CC8118B1614FA3A2D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-05_3c8ac85e1461768e0db87eae606e76d3_elex_gh0st-rat_nitol_scribble_virut_wannacry.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-05_3c8ac85e1461768e0db87eae606e76d3_elex_gh0st-rat_nitol_scribble_virut_wannacry.exe
Resource
win11ltsc2024-20260630-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-05_3c8ac85e1461768e0db87eae606e76d3_elex_gh0st-rat_nitol_scribble_virut_wannacry
- Size 64KB
- SHA256 bac86178c4811a3b74d52bc0355c19cf0362a9af4443b4679fd06b693cac81fa
- MD5 3c8ac85e1461768e0db87eae606e76d3
- SHA1 d91257587b596e6fc93f3785d443eca235a49c55
- SHA512 96060f9beecdd499d553a3e194fd6cf9c31a07b4a11c437bf7c1e00477673a93e66da1b6d2c6d4faa17e7db4f6be7d65fceb142af9b1063a204e7d4fd27daa99
- SSDEEP 1536:Ma9iexVfevkrojyHDml5SweIbeWfpr1a+ARc:r9/jf6kuyHDGSrjWfza+AR
- TLSH T10353BF57ED8754F2E16210BC786AB3B559EF0C72462F719BDF90CC8118B1614FA3A2D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies firewall policy service
-
Detects Windows executables referencing non-Windows User-Agents
-
Executes dropped EXE
-
Drops file in System32 directory