2026-07-09_4a8e66465c85193e3803bc15db97babe_elex_gh0st-rat_nitol_scribble_virut_wannacry

General

Target
2026-07-09_4a8e66465c85193e3803bc15db97babe_elex_gh0st-rat_nitol_scribble_virut_wannacry
Size 65KB
Sample260709-kk3ppaft7m
SHA256 f2029f0eddb85457c4568eabfe61a161e451e2f7716caeb6a1e07db3e1ddb048
MD5 4a8e66465c85193e3803bc15db97babe
SHA1 0c7a975cc6d2276df7f8ae47ab5f519c1c0e44a0
SHA512 f007518439c1ca4c6781b620ac3d9627b55d39cf0effc0092a25c459b17049872213ed250d4d8664d6cd3b2e8f31fbc11480ce276350116d744c09b2d6efddce
SSDEEP 768:n68uUCS77GhGLhLpms1RZo9yHHojY9Pesdq1aP1I61Gl2mOl4ZL9EBE/RWLmQv:n6BS7LL18+o9yHSmXdhPF11mNTgz
TLSH
T1C853AF43DDC658B2D05604B031AFA7B6A6FF0CFA471F12ABEF80DD8128B4664F965096
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-09_4a8e66465c85193e3803bc15db97babe_elex_gh0st-rat_nitol_scribble_virut_wannacry

File Explorer

2026-07-09_4a8e66465c85193e3803bc15db97babe_elex_gh0st-rat_nitol_scribble_virut_wannacry

.exe 65KB

2026-07-09_4a8e66465c85193e3803bc15db97babe_elex_gh0st-rat_nitol_scribble_virut_wannacry

IMPHASH 3bb7c80eb100b0ef5af9d6406a8cea4a
SHA256 f2029f0eddb85457c4568eabfe61a161e451e2f7716caeb6a1e07db3e1ddb048
MD5 4a8e66465c85193e3803bc15db97babe
SHA1 0c7a975cc6d2276df7f8ae47ab5f519c1c0e44a0
SHA512 f007518439c1ca4c6781b620ac3d9627b55d39cf0effc0092a25c459b17049872213ed250d4d8664d6cd3b2e8f31fbc11480ce276350116d744c09b2d6efddce
SSDEEP 768:n68uUCS77GhGLhLpms1RZo9yHHojY9Pesdq1aP1I61Gl2mOl4ZL9EBE/RWLmQv:n6BS7LL18+o9yHSmXdhPF11mNTgz
TLSH
T1C853AF43DDC658B2D05604B031AFA7B6A6FF0CFA471F12ABEF80DD8128B4664F965096
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Windows executables referencing non-Windows User-Agents
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

79706

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

shlwapi

StrStrA

wininet

InternetOpenUrlA InternetReadFile InternetCloseHandle

winmm

timeGetTime

msvcrt

_controlfp __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit fopen fclose fseek ftell fread ??2@YAPAXI@Z malloc sprintf rand _except_handler3 strncmp strstr strcspn strncpy atoi

kernel32

OpenMutexA GetStartupInfoA GetModuleFileNameA VirtualAlloc VirtualAllocEx VirtualProtectEx GetModuleHandleA WriteProcessMemory SetThreadContext ResumeThread GetThreadContext ReadProcessMemory VirtualQueryEx CreateProcessA TerminateProcess ExitThread RaiseException InterlockedExchange LocalAlloc GetLocaleInfoW GetComputerNameA GlobalMemoryStatusEx GetTickCount GetSystemDirectoryA CopyFileA CreateMutexA WaitForSingleObject lstrcpyA GetFileAttributesA GetFileSize GlobalAlloc ReadFile GlobalFree BeginUpdateResourceA UpdateResourceA EndUpdateResourceA EnumResourceNamesA CreateThread Sleep FreeLibrary GetProcAddress LoadLibraryA DeleteFileA ExitProcess WinExec lstrcatA ReleaseMutex GetLastError lstrlenA lstrcpynA CreateFileA CloseHandle MoveFileExA GetTempPathA WriteFile LockResource LoadResource SizeofResource FindResourceA

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-09_4a8e66465c85193e3803bc15db97babe_elex_gh0st-rat_nitol_scribble_virut_wannacry

shlwapi

wininet

winmm

msvcrt

kernel32

generic