General
- Target 2026-08-01_3800f63f9142dfe63b4c4245d3e01a2e_elex_gh0st-rat_remcos_wannacry
- Size 50KB
- Sample260801-rd1p3sxfph
- SHA256 73416c7747f2375e60601a12c55b65f77c1de589f5b375d398fc5439d5949b4a
- MD5 3800f63f9142dfe63b4c4245d3e01a2e
- SHA1 fcde4b00376408e1cd346da2aa074e8106e50533
- SHA512 4723b07dbc97dba0e35f6f086cc7d008c0883a5a077d18b8620b7f2dbe53d57d9996b12453f5c23582eeb2e9b9035209cc0f2d502800847eab333fbdcf4d18d3
- SSDEEP 768:24iWi9dJ7yZ9yHJGEfSKvr8WG7H7gor+ZlqiIyYbd+E23zNdoTA2L2HT:2zW4eyHJrfS//goCPZT3z/V2qHT
- TLSH T180337E43ED5200B7E0270178941B9B6716B76D12051BBFDAAF80DDC5EC729BAECB0267
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-01_3800f63f9142dfe63b4c4245d3e01a2e_elex_gh0st-rat_remcos_wannacry.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_3800f63f9142dfe63b4c4245d3e01a2e_elex_gh0st-rat_remcos_wannacry.exe
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-01_3800f63f9142dfe63b4c4245d3e01a2e_elex_gh0st-rat_remcos_wannacry
- Size 50KB
- SHA256 73416c7747f2375e60601a12c55b65f77c1de589f5b375d398fc5439d5949b4a
- MD5 3800f63f9142dfe63b4c4245d3e01a2e
- SHA1 fcde4b00376408e1cd346da2aa074e8106e50533
- SHA512 4723b07dbc97dba0e35f6f086cc7d008c0883a5a077d18b8620b7f2dbe53d57d9996b12453f5c23582eeb2e9b9035209cc0f2d502800847eab333fbdcf4d18d3
- SSDEEP 768:24iWi9dJ7yZ9yHJGEfSKvr8WG7H7gor+ZlqiIyYbd+E23zNdoTA2L2HT:2zW4eyHJrfS//goCPZT3z/V2qHT
- TLSH T180337E43ED5200B7E0270178941B9B6716B76D12051BBFDAAF80DDC5EC729BAECB0267
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects Windows executables referencing non-Windows User-Agents
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory