stormser | 2026-08-01_097c3b6aa3e3dec0cdc11f7abd52e6de_elex_remcos_wannacry

General

Target
2026-08-01_097c3b6aa3e3dec0cdc11f7abd52e6de_elex_remcos_wannacry
Size 84KB
Sample260801-2cb1faydjd
SHA256 de806e56b756269285a00f22b71754c1a00d9a8561b5c6960c63cdbdd3f43298
MD5 097c3b6aa3e3dec0cdc11f7abd52e6de
SHA1 53c41419a0ea0cad9daa3d058d8dcef7170d740d
SHA512 54f80a75b3992a2736972768898a22f5c73ee45b5931e72079b08fdb44cbf68629c32d8dbd122d20d69cf29719c9229a320e1817847e44e3323da378d2ff623f
SSDEEP 384:6jibD2liXsafEHsc4g6FW6e/hHjN94/CFsrdHWMZ:6jif24cafxi6FW7/hHjN94/wQpWMZ
TLSH
T117833A435F9A7CF2F3911175046A8E79A76B89D4D1AEFE9FBF80CC084462641E83A306
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

worm stormser

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 1 IoCs

resource	yara_rule
sample	family_stormser

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_097c3b6aa3e3dec0cdc11f7abd52e6de_elex_remcos_wannacry

SHA256 de806e56b756269285a00f22b71754c1a00d9a8561b5c6960c63cdbdd3f43298
MD5 097c3b6aa3e3dec0cdc11f7abd52e6de
SHA1 53c41419a0ea0cad9daa3d058d8dcef7170d740d
SHA512 54f80a75b3992a2736972768898a22f5c73ee45b5931e72079b08fdb44cbf68629c32d8dbd122d20d69cf29719c9229a320e1817847e44e3323da378d2ff623f
SSDEEP 384:6jibD2liXsafEHsc4g6FW6e/hHjN94/CFsrdHWMZ:6jif24cafxi6FW7/hHjN94/wQpWMZ
TLSH
T117833A435F9A7CF2F3911175046A8E79A76B89D4D1AEFE9FBF80CC084462641E83A306
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

9844

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths