General
- Target 2026-07-07_087e18a7666a82a93974f0bdfc755d23_elex_gh0st-rat_nitol_scribble_virut_wannacry
- Size 64KB
- Sample260707-3qj4msgz2n
- SHA256 feb2d098a5d16130a7fbfd23e3f0da31720b331e6651a846bf609b0ea761bff8
- MD5 087e18a7666a82a93974f0bdfc755d23
- SHA1 9b353379a3abe8278ff32fdda21e37e657bf5a03
- SHA512 9f4ca647467eb9bbc5bf28c50f448d45aff54d3b4267142a587990ab1da7e68670c1727ba216b45ffb07c4dc1584925ed8f8675791dc071c90bec75119811979
- SSDEEP 1536:CWKTqHmkYKoRyHKAmLitdk2Tob2QwNllAfSz:5KSFYByHKA2Mk2sGN71
- TLSH T12753BF47FC4654E2E1124038397AA7F368EF4C72475EA197EF80DD892CB0528FA766C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-07_087e18a7666a82a93974f0bdfc755d23_elex_gh0st-rat_nitol_scribble_virut_wannacry.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-07_087e18a7666a82a93974f0bdfc755d23_elex_gh0st-rat_nitol_scribble_virut_wannacry.exe
Resource
win11ltsc2024-20260706-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-07_087e18a7666a82a93974f0bdfc755d23_elex_gh0st-rat_nitol_scribble_virut_wannacry
- Size 64KB
- SHA256 feb2d098a5d16130a7fbfd23e3f0da31720b331e6651a846bf609b0ea761bff8
- MD5 087e18a7666a82a93974f0bdfc755d23
- SHA1 9b353379a3abe8278ff32fdda21e37e657bf5a03
- SHA512 9f4ca647467eb9bbc5bf28c50f448d45aff54d3b4267142a587990ab1da7e68670c1727ba216b45ffb07c4dc1584925ed8f8675791dc071c90bec75119811979
- SSDEEP 1536:CWKTqHmkYKoRyHKAmLitdk2Tob2QwNllAfSz:5KSFYByHKA2Mk2sGN71
- TLSH T12753BF47FC4654E2E1124038397AA7F368EF4C72475EA197EF80DD892CB0528FA766C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies firewall policy service
-
Detects Windows executables referencing non-Windows User-Agents
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Drops file in System32 directory