2026-08-02_a4a1fb43fc467c89be94defbede7fedf_elex_nitol_remcos_wannacry

General

Target
2026-08-02_a4a1fb43fc467c89be94defbede7fedf_elex_nitol_remcos_wannacry
Size 67KB
Sample260802-j37wpafe67
SHA256 89acd49143358ec339f4d3b779d9f8223fa39dc780bc72be1d1dc087da58148b
MD5 a4a1fb43fc467c89be94defbede7fedf
SHA1 99361ba5eacd955bbed68efd4ca5cb063c9130a2
SHA512 44619f7f42391b1bb14857f45bc51878b4ab4327cc796d570fde4ced11f8daf8ff83963e37dfe022ff39a467e8a81bfd90ed05edbe58dbb27d9e0a09c1de6d96
SSDEEP 1536:MDcfLfIb5Ep1uzgyXVdtnqHNWnnnvMMMMw:MD2LTnuzgyXVd1mYMMMMw
TLSH
T150633BA6F5808497E45701388842F7F2A9A2BC35C94EAA52FF80BF4F5C79E55FE20507
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-02_a4a1fb43fc467c89be94defbede7fedf_elex_nitol_remcos_wannacry

File Explorer

2026-08-02_a4a1fb43fc467c89be94defbede7fedf_elex_nitol_remcos_wannacry

.exe 67KB

2026-08-02_a4a1fb43fc467c89be94defbede7fedf_elex_nitol_remcos_wannacry

IMPHASH 44d09e288cc76827b62dde98d4028728
SHA256 89acd49143358ec339f4d3b779d9f8223fa39dc780bc72be1d1dc087da58148b
MD5 a4a1fb43fc467c89be94defbede7fedf
SHA1 99361ba5eacd955bbed68efd4ca5cb063c9130a2
SHA512 44619f7f42391b1bb14857f45bc51878b4ab4327cc796d570fde4ced11f8daf8ff83963e37dfe022ff39a467e8a81bfd90ed05edbe58dbb27d9e0a09c1de6d96
SSDEEP 1536:MDcfLfIb5Ep1uzgyXVdtnqHNWnnnvMMMMw:MD2LTnuzgyXVd1mYMMMMw
TLSH
T150633BA6F5808497E45701388842F7F2A9A2BC35C94EAA52FF80BF4F5C79E55FE20507
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Windows executables referencing non-Windows User-Agents
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

14678

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mfc42

ord823 ord825

msvcrt

_controlfp __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit strncmp _except_handler3 strstr strcspn strncpy atoi time srand rand realloc free malloc sprintf

kernel32

ExitProcess Sleep lstrcpyA CreateProcessA TerminateProcess ExitThread GetStartupInfoA GetModuleHandleA WaitForSingleObject CreateFileA SetFilePointer WriteFile lstrcpynA lstrlenA OpenMutexA ReleaseMutex GetComputerNameA GetCurrentProcess GetCurrentThread CloseHandle CreateThread LoadLibraryA GetProcAddress GetSystemDefaultUILanguage GetTickCount

user32

GetDesktopWindow wsprintfA

shell32

SHChangeNotify ShellExecuteExA ShellExecuteA

shlwapi

SHDeleteKeyA

ws2_32

setsockopt recv __WSAFDIsSet select WSAIoctl closesocket WSAStartup inet_ntoa htonl WSACleanup socket connect send inet_addr sendto htons

iphlpapi

GetIfTable GetAdaptersInfo

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-02_a4a1fb43fc467c89be94defbede7fedf_elex_nitol_remcos_wannacry

mfc42

msvcrt

kernel32

user32

shell32

shlwapi

ws2_32

iphlpapi

generic