General
- Target 2026-07-08_8fa992848407128f2ebd4308c55f66a5_elex_gh0st-rat_scribble_strictor_virut_wannacry
- Size 81KB
- Sample260708-kc87hads8w
- SHA256 586f727f4d6b6029758ebf7751bb0d8245f343e84477ee31f00d1bd1094b7e07
- MD5 8fa992848407128f2ebd4308c55f66a5
- SHA1 49f28e19fc45bdd1466e53ec3c8b7baea2cf76e9
- SHA512 e5d3437ca366d4dc9cec888f9491cc07177a9f12a6a496892e9a34b25cab3763f01dd1e233dd97dc2599cf4259483bd41001cc237c9df2a3bbc376a4fcfb0d52
- SSDEEP 1536:3txwjjK7lp27GjV3P1YECldoyzrmgan6agEp97DQ:dqjmlCliyzr9anf7DQ
- TLSH T17883BE43ED8510F2D016403C787BA7B95AA78CF24B5FA197DF40EC4D68B6A14FA36308
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-08_8fa992848407128f2ebd4308c55f66a5_elex_gh0st-rat_scribble_strictor_virut_wannacry.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_8fa992848407128f2ebd4308c55f66a5_elex_gh0st-rat_scribble_strictor_virut_wannacry.exe
Resource
win11ltsc2024-20260706-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-08_8fa992848407128f2ebd4308c55f66a5_elex_gh0st-rat_scribble_strictor_virut_wannacry
- Size 81KB
- SHA256 586f727f4d6b6029758ebf7751bb0d8245f343e84477ee31f00d1bd1094b7e07
- MD5 8fa992848407128f2ebd4308c55f66a5
- SHA1 49f28e19fc45bdd1466e53ec3c8b7baea2cf76e9
- SHA512 e5d3437ca366d4dc9cec888f9491cc07177a9f12a6a496892e9a34b25cab3763f01dd1e233dd97dc2599cf4259483bd41001cc237c9df2a3bbc376a4fcfb0d52
- SSDEEP 1536:3txwjjK7lp27GjV3P1YECldoyzrmgan6agEp97DQ:dqjmlCliyzr9anf7DQ
- TLSH T17883BE43ED8510F2D016403C787BA7B95AA78CF24B5FA197DF40EC4D68B6A14FA36308
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects Windows executables referencing non-Windows User-Agents
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.