2026-08-21_ad90667beba1ceeffd8661d24324d61e_elex_gh0st_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-21_ad90667beba1ceeffd8661d24324d61e_elex_gh0st_wannacry
Size 45KB
Sample260822-j4c3psfp5x
SHA256 46ea409ff7e0f0d9fc998b20bc9ea9f859981b6fd9a510898af52c7d925ab792
MD5 ad90667beba1ceeffd8661d24324d61e
SHA1 8d2084fe59961eee41dbd677f42e0d987f734ed0
SHA512 6b2962197407f25358a5cba65b497173fcdf80f7690480fe2739fdaa405ac4b809289a8f98566c12d0cd0920e9cb10bb4ea8102a56d042d47cda0d5a67032841
SSDEEP 768:d8Pa2fHRDhgJJXwhOhuFnToIf1KHDCC2lZ9/x:mP3RDhgjUFnToIf6ix
TLSH
T157238E42EA80C4F7F084657490EAE37DEF3731594365A6AB6780FF297835121E7293CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-21_ad90667beba1ceeffd8661d24324d61e_elex_gh0st_wannacry

File Explorer

2026-08-21_ad90667beba1ceeffd8661d24324d61e_elex_gh0st_wannacry

.exe 45KB

2026-08-21_ad90667beba1ceeffd8661d24324d61e_elex_gh0st_wannacry

IMPHASH 9aaea1176296d74212e8d65f0d016c36
SHA256 46ea409ff7e0f0d9fc998b20bc9ea9f859981b6fd9a510898af52c7d925ab792
MD5 ad90667beba1ceeffd8661d24324d61e
SHA1 8d2084fe59961eee41dbd677f42e0d987f734ed0
SHA512 6b2962197407f25358a5cba65b497173fcdf80f7690480fe2739fdaa405ac4b809289a8f98566c12d0cd0920e9cb10bb4ea8102a56d042d47cda0d5a67032841
SSDEEP 768:d8Pa2fHRDhgJJXwhOhuFnToIf1KHDCC2lZ9/x:mP3RDhgjUFnToIf6ix
TLSH
T157238E42EA80C4F7F084657490EAE37DEF3731594365A6AB6780FF297835121E7293CA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

31480

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CopyFileA MoveFileA GetCurrentProcess Process32Next GetPriorityClass OpenProcess Module32First Process32First CreateToolhelp32Snapshot TerminateProcess lstrcpyA WaitForSingleObject CreateThread lstrcpynA DeleteFileA MoveFileExA GetModuleFileNameA GetTickCount SetThreadPriority GetCurrentThread GetFileSize CreateFileA WriteFile GlobalMemoryStatus GetVersionExA GetComputerNameA InterlockedExchange GetCurrentThreadId FindFirstFileA FileTimeToLocalFileTime FileTimeToSystemTime GetLastError FindNextFileA FindClose LoadLibraryA GetProcAddress FreeLibrary CreatePipe CloseHandle GetStartupInfoA GetSystemDirectoryA CreateProcessA ReadFile WinExec Sleep GetModuleHandleA

user32

CloseWindowStation SetCursorPos GetDesktopWindow wsprintfA keybd_event ExitWindowsEx mouse_event CreateWindowExA CloseWindow SendMessageA IsWindow GetSystemMetrics SetThreadDesktop OpenDesktopA SetProcessWindowStation OpenWindowStationA GetThreadDesktop GetProcessWindowStation CloseDesktop

gdi32

CreateCompatibleDC CreateCompatibleBitmap SelectObject BitBlt GetDIBits CreateDCA DeleteObject DeleteDC

advapi32

LookupPrivilegeValueA OpenProcessToken AdjustTokenPrivileges

shell32

ShellExecuteA SHGetFileInfoA

avicap32

capCreateCaptureWindowA capGetDriverDescriptionA

ws2_32

htons connect closesocket shutdown WSAStartup inet_addr gethostbyname recv send setsockopt WSAIoctl socket

msvcrt

_except_handler3 exit _XcptFilter _exit free malloc _strlwr _ftol __CxxFrameHandler ??2@YAPAXI@Z ??3@YAXPAX@Z strstr strcspn atoi strncpy sprintf strncat __getmainargs _initterm __setusermatherr _adjust_fdiv __p__commode _controlfp _acmdln __set_app_type __p__fmode

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-21_ad90667beba1ceeffd8661d24324d61e_elex_gh0st_wannacry

kernel32

user32

gdi32

advapi32

shell32

avicap32

ws2_32

msvcrt

generic