General
- Target 2026-08-08_91af6783edb8a8c18bf59d10815d4cee_elex_gh0st-rat_nitol_remcos_scribble_virut_wannacry
- Size 65KB
- Sample260808-s9ctkazdka
- SHA256 45032c8905b187fa7b1024d13f728b5f0621a840f4f263969f39a6664fa238c1
- MD5 91af6783edb8a8c18bf59d10815d4cee
- SHA1 9d2c57c3da0c9fcbbc0e7c21164f60451e54ed44
- SHA512 5353ca157d1d334394c9421369813be956b28441d997fb5c41b9561244d4cc842b7a145a2fb29dfc5f83e387b23506344d5b1d20694b853a18441f6aff4384e7
- SSDEEP 768:y68uUCS77GhGLhLpms1R6o9yHHojY9P8FbTVGwVRkG5pZAX7n5HsL+n:y6BS7LL18do9yHSmUtTZV2G2X7FX
- TLSH T11A53AE43EED764E2D05614B031AE97BB98BF0CF7860E6297EBC0CDC228B4264F936555
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-08_91af6783edb8a8c18bf59d10815d4cee_elex_gh0st-rat_nitol_remcos_scribble_virut_wannacry.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_91af6783edb8a8c18bf59d10815d4cee_elex_gh0st-rat_nitol_remcos_scribble_virut_wannacry.exe
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-08_91af6783edb8a8c18bf59d10815d4cee_elex_gh0st-rat_nitol_remcos_scribble_virut_wannacry
- Size 65KB
- SHA256 45032c8905b187fa7b1024d13f728b5f0621a840f4f263969f39a6664fa238c1
- MD5 91af6783edb8a8c18bf59d10815d4cee
- SHA1 9d2c57c3da0c9fcbbc0e7c21164f60451e54ed44
- SHA512 5353ca157d1d334394c9421369813be956b28441d997fb5c41b9561244d4cc842b7a145a2fb29dfc5f83e387b23506344d5b1d20694b853a18441f6aff4384e7
- SSDEEP 768:y68uUCS77GhGLhLpms1R6o9yHHojY9P8FbTVGwVRkG5pZAX7n5HsL+n:y6BS7LL18do9yHSmUtTZV2G2X7FX
- TLSH T11A53AE43EED764E2D05614B031AE97BB98BF0CF7860E6297EBC0CDC228B4264F936555
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies firewall policy service
-
Detects Windows executables referencing non-Windows User-Agents
-
Executes dropped EXE
-
Drops file in System32 directory