2026-09-05_6974ce51559a68c8dbbab912c721f644_derusbi_elex_glassworm_lockbit_wannacry

General

Target
2026-09-05_6974ce51559a68c8dbbab912c721f644_derusbi_elex_glassworm_lockbit_wannacry
Size 4.9MB
Sample260907-xvertsssa1
SHA256 d9c171bf94007173dcdb821d7ee36cfa14faf5a2f3689067809de902fde6239b
MD5 6974ce51559a68c8dbbab912c721f644
SHA1 83d22e26993b435e41ca5e5eb0a1675ce856e43c
SHA512 8915a1b7a4c6f31d056c1b8f0e75cb71356e2b4f0d69e686be665a5b84dafeac11d19e46a03841bb512098df018a11e6e1151f73e3726b11f9ee891e17a5a894
SSDEEP 24576:dzvTP1IH4+Y8cLq6Xpn9GWayJT5bM9sBaw9S3zIp0T7OANf22ad+UFZAB5diU6c:dWYj8b3+87bfLK
TLSH
T1F836112839E96A2BD21AF1F1DFC6F197C203A269D1038B2F61B51B176210D116DD7E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Detects executables referencing many Password Manager software clients. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_References_PasswordManagers

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-05_6974ce51559a68c8dbbab912c721f644_derusbi_elex_glassworm_lockbit_wannacry

2026-09-05_6974ce51559a68c8dbbab912c721f644_derusbi_elex_glassworm_lockbit_wannacry

.exe 4.9MB

IMPHASH 240dc081581b0e322f4d2a0da6154157
SHA256 d9c171bf94007173dcdb821d7ee36cfa14faf5a2f3689067809de902fde6239b
MD5 6974ce51559a68c8dbbab912c721f644
SHA1 83d22e26993b435e41ca5e5eb0a1675ce856e43c
SHA512 8915a1b7a4c6f31d056c1b8f0e75cb71356e2b4f0d69e686be665a5b84dafeac11d19e46a03841bb512098df018a11e6e1151f73e3726b11f9ee891e17a5a894
SSDEEP 24576:dzvTP1IH4+Y8cLq6Xpn9GWayJT5bM9sBaw9S3zIp0T7OANf22ad+UFZAB5diU6c:dWYj8b3+87bfLK
TLSH
T1F836112839E96A2BD21AF1F1DFC6F197C203A269D1038B2F61B51B176210D116DD7E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables referencing many IR and analysis tools
Detects executables referencing many Password Manager software clients. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4640

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths