stormser | 2026-08-01_9afbde2486db2cfe0316cc783d75e46a_elex_remcos_wannacry

General

Target
2026-08-01_9afbde2486db2cfe0316cc783d75e46a_elex_remcos_wannacry
Size 84KB
Sample260802-emdkpatgpf
SHA256 f9bd4ae7831a2071d1c7a6f26f38005e47d3169a1a97bc35a55aae7ff1c8357e
MD5 9afbde2486db2cfe0316cc783d75e46a
SHA1 fb4bbce6915b9a242dedc08d93f80479a5bca403
SHA512 b574a82f29d605cdba8f0b23e38f9b6f304f81e8c3ff116126c328dc935055b44082f6051bf4b94e081cc8207a9eb27f4591ee5c520de98a59332da50fa7643b
SSDEEP 384:6jibD2liXsafEHsc4g6FW6e/hHjNU4/CFsrdHWMZ:6jif24cafxi6FW7/hHjNU4/wQpWMZ
TLSH
T10F832A435F9A7CF2F7911175046A8E79A76B89D4D1AEFE9FBF80CC084462641F83A306
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

worm stormser

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 1 IoCs

resource	yara_rule
sample	family_stormser

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_9afbde2486db2cfe0316cc783d75e46a_elex_remcos_wannacry

SHA256 f9bd4ae7831a2071d1c7a6f26f38005e47d3169a1a97bc35a55aae7ff1c8357e
MD5 9afbde2486db2cfe0316cc783d75e46a
SHA1 fb4bbce6915b9a242dedc08d93f80479a5bca403
SHA512 b574a82f29d605cdba8f0b23e38f9b6f304f81e8c3ff116126c328dc935055b44082f6051bf4b94e081cc8207a9eb27f4591ee5c520de98a59332da50fa7643b
SSDEEP 384:6jibD2liXsafEHsc4g6FW6e/hHjNU4/CFsrdHWMZ:6jif24cafxi6FW7/hHjNU4/wQpWMZ
TLSH
T10F832A435F9A7CF2F7911175046A8E79A76B89D4D1AEFE9FBF80CC084462641F83A306
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

9844

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths