2026-07-15_e913b2b1509294f70f9ad560dcfb8bd2_elex_gh0st-rat_nitol_scribble_virut_wannacry

General

Target
2026-07-15_e913b2b1509294f70f9ad560dcfb8bd2_elex_gh0st-rat_nitol_scribble_virut_wannacry
Size 38KB
Sample260715-k4djxabx21
SHA256 80e7de7c8e0095f3b901f326eaca17f3037f5ce61892354ec2fecdf7f150a222
MD5 e913b2b1509294f70f9ad560dcfb8bd2
SHA1 e10a79ac0276632dd6d47e45ff83a554c2d9d2b6
SHA512 b4561ce9c271ab888530b8c582b34a83c9ffaf27150094ff39136995ae4dcd7c3cd4eba63486bf64db66162af675ab3265a33944a33308f1d321e818bef17da0
SSDEEP 384:Xm//68fGt5QCSRRpV7dE5d3HHGiJkesKGhMUKBMfZ3A966TKbKED116qvHe66fAC:O68uUCS77GhGLhLpmM1R6o9yHHojY9P5
TLSH
T14B033B53EDC664F2D05600B431EFA7BA99FF0CFA461F2197EB80CDC228B4664E935156
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-15_e913b2b1509294f70f9ad560dcfb8bd2_elex_gh0st-rat_nitol_scribble_virut_wannacry

File Explorer

2026-07-15_e913b2b1509294f70f9ad560dcfb8bd2_elex_gh0st-rat_nitol_scribble_virut_wannacry

.exe 38KB

2026-07-15_e913b2b1509294f70f9ad560dcfb8bd2_elex_gh0st-rat_nitol_scribble_virut_wannacry

IMPHASH 3bb7c80eb100b0ef5af9d6406a8cea4a
SHA256 80e7de7c8e0095f3b901f326eaca17f3037f5ce61892354ec2fecdf7f150a222
MD5 e913b2b1509294f70f9ad560dcfb8bd2
SHA1 e10a79ac0276632dd6d47e45ff83a554c2d9d2b6
SHA512 b4561ce9c271ab888530b8c582b34a83c9ffaf27150094ff39136995ae4dcd7c3cd4eba63486bf64db66162af675ab3265a33944a33308f1d321e818bef17da0
SSDEEP 384:Xm//68fGt5QCSRRpV7dE5d3HHGiJkesKGhMUKBMfZ3A966TKbKED116qvHe66fAC:O68uUCS77GhGLhLpmM1R6o9yHHojY9P5
TLSH
T14B033B53EDC664F2D05600B431EFA7BA99FF0CFA461F2197EB80CDC228B4664E935156
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Windows executables referencing non-Windows User-Agents
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

24815

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

shlwapi

StrStrA

wininet

InternetOpenUrlA InternetReadFile InternetCloseHandle

winmm

timeGetTime

msvcrt

_controlfp __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit fopen fclose fseek ftell fread ??2@YAPAXI@Z malloc sprintf rand _except_handler3 strncmp strstr strcspn strncpy atoi

kernel32

OpenMutexA GetStartupInfoA GetModuleFileNameA VirtualAlloc VirtualAllocEx VirtualProtectEx GetModuleHandleA WriteProcessMemory SetThreadContext ResumeThread GetThreadContext ReadProcessMemory VirtualQueryEx CreateProcessA TerminateProcess ExitThread RaiseException InterlockedExchange LocalAlloc GetLocaleInfoW GetComputerNameA GlobalMemoryStatusEx GetTickCount GetSystemDirectoryA CopyFileA CreateMutexA WaitForSingleObject lstrcpyA GetFileAttributesA GetFileSize GlobalAlloc ReadFile GlobalFree BeginUpdateResourceA UpdateResourceA EndUpdateResourceA EnumResourceNamesA CreateThread Sleep FreeLibrary GetProcAddress LoadLibraryA DeleteFileA ExitProcess WinExec lstrcatA ReleaseMutex GetLastError lstrlenA lstrcpynA CreateFileA CloseHandle MoveFileExA GetTempPathA WriteFile LockResource LoadResource SizeofResource FindResourceA

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-15_e913b2b1509294f70f9ad560dcfb8bd2_elex_gh0st-rat_nitol_scribble_virut_wannacry

shlwapi

wininet

winmm

msvcrt

kernel32

generic