General
- Target 2026-08-10_9d3fc1dc0a2884eb63328836d9bf42a7_elex_gh0st-rat_nitol_remcos_scribble_virut_wannacry
- Size 65KB
- Sample260810-grckased79
- SHA256 32cb552704bf31ddf61c5586a876ea81753ad33950477f624c15c04af3b95432
- MD5 9d3fc1dc0a2884eb63328836d9bf42a7
- SHA1 f406da98714c6b857cedee4fd6689d5f5ea26768
- SHA512 11a1cfddebc8b5cb2935bbb0a179c4571bac8b0032795f77e6c8bfc36e41714f9fa0dc97894c745c87e28ea1ba4c086951e8e1d88804c62ccdcf0436be19e02f
- SSDEEP 1536:D6BS7LL188o9yHSmaj3ptLGVoBPFV5rFgcPDr9D2:uBon18jyHSn3LG+BPH5hhPDrJ
- TLSH T11053BF53EDC664F2C14A14B430EEE7B655BF0CFB431B628BEB81DDC238B4264E525166
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-10_9d3fc1dc0a2884eb63328836d9bf42a7_elex_gh0st-rat_nitol_remcos_scribble_virut_wannacry.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_9d3fc1dc0a2884eb63328836d9bf42a7_elex_gh0st-rat_nitol_remcos_scribble_virut_wannacry.exe
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-10_9d3fc1dc0a2884eb63328836d9bf42a7_elex_gh0st-rat_nitol_remcos_scribble_virut_wannacry
- Size 65KB
- SHA256 32cb552704bf31ddf61c5586a876ea81753ad33950477f624c15c04af3b95432
- MD5 9d3fc1dc0a2884eb63328836d9bf42a7
- SHA1 f406da98714c6b857cedee4fd6689d5f5ea26768
- SHA512 11a1cfddebc8b5cb2935bbb0a179c4571bac8b0032795f77e6c8bfc36e41714f9fa0dc97894c745c87e28ea1ba4c086951e8e1d88804c62ccdcf0436be19e02f
- SSDEEP 1536:D6BS7LL188o9yHSmaj3ptLGVoBPFV5rFgcPDr9D2:uBon18jyHSn3LG+BPH5hhPDrJ
- TLSH T11053BF53EDC664F2C14A14B430EEE7B655BF0CFB431B628BEB81DDC238B4264E525166
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies firewall policy service
-
Detects Windows executables referencing non-Windows User-Agents
-
Executes dropped EXE
-
Drops file in System32 directory