General
- Target 2026-09-03_c47311f27186c7f183134c025aa01ad6_elex_wannacry
- Size 53KB
- Sample260905-1jdbeaal71
- SHA256 600fd231221a5e496bbb86cee2297fd021d94bede6efef445dda52c0c2e9bf9f
- MD5 c47311f27186c7f183134c025aa01ad6
- SHA1 5ec5a5955f8e5e68f6582f108658229f7139e472
- SHA512 f41df47fa70be222e36908b05f8672b4d13793dea5ed89ee4e3aefeeab9f7f5a35a5cfba36803d5a74b0abec42d1f1058bebc6226c726aa39338230c66c5a6c5
- SSDEEP 768:p7BlphA7dASbSLJJBZBZaOAOIB3jM2jMO/7OSfT8SKpPyskHaucd:p7ZhA7dAxJJB7LD2I2IbSss6ucd
- TLSH T198334B3D2FA9D420F02BB139FE1B38398536728F71A7E6FAB529393455F33A09509914
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-09-03_c47311f27186c7f183134c025aa01ad6_elex_wannacry.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-03_c47311f27186c7f183134c025aa01ad6_elex_wannacry.exe
Resource
win11ltsc2024-20260710-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-03_c47311f27186c7f183134c025aa01ad6_elex_wannacry
- Size 53KB
- SHA256 600fd231221a5e496bbb86cee2297fd021d94bede6efef445dda52c0c2e9bf9f
- MD5 c47311f27186c7f183134c025aa01ad6
- SHA1 5ec5a5955f8e5e68f6582f108658229f7139e472
- SHA512 f41df47fa70be222e36908b05f8672b4d13793dea5ed89ee4e3aefeeab9f7f5a35a5cfba36803d5a74b0abec42d1f1058bebc6226c726aa39338230c66c5a6c5
- SSDEEP 768:p7BlphA7dASbSLJJBZBZaOAOIB3jM2jMO/7OSfT8SKpPyskHaucd:p7ZhA7dAxJJB7LD2I2IbSss6ucd
- TLSH T198334B3D2FA9D420F02BB139FE1B38398536728F71A7E6FAB529393455F33A09509914
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects Cosmu payload
Cosmu is a worm written in C++.
-
Renames multiple (4960) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.