2026-09-29_37c263f9ef0fa68e67a2a1a2064c616d_elex_gh0st-rat_remcos_wannacry

General

Target
2026-09-29_37c263f9ef0fa68e67a2a1a2064c616d_elex_gh0st-rat_remcos_wannacry
Size 50KB
Sample260930-12razssalb
SHA256 0c5241a44cc4e23841cc7030ca57dde4111e183044e68000c6a292cac20834fe
MD5 37c263f9ef0fa68e67a2a1a2064c616d
SHA1 7702091bf33e1bcfa4d1003244e63ef39ff7faa6
SHA512 e29e0ad3a9228c15d8f987af62200e7d8f5ec802158ecf7f6c62fe9a46a3843cad4fe0ee8aa3c69facf6785ba9a0bbec8ddce06b252623c3f6c719ee9392fd0c
SSDEEP 768:24iWi9dJ7yZ9yHJGEfSKvr8WG7H7gor+ZlqiIyYbd+E23zNdoTA2/2HT:2zW4eyHJrfS//goCPZT3z/V2OHT
TLSH
T14E337E43ED5200B7E0270178941B9B6716B76D12051BBFDAAF80DDC5EC729BAECB0267
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_37c263f9ef0fa68e67a2a1a2064c616d_elex_gh0st-rat_remcos_wannacry

File Explorer

2026-09-29_37c263f9ef0fa68e67a2a1a2064c616d_elex_gh0st-rat_remcos_wannacry

.exe 50KB

2026-09-29_37c263f9ef0fa68e67a2a1a2064c616d_elex_gh0st-rat_remcos_wannacry

IMPHASH cf184f13449058ca8bca225bb7551111
SHA256 0c5241a44cc4e23841cc7030ca57dde4111e183044e68000c6a292cac20834fe
MD5 37c263f9ef0fa68e67a2a1a2064c616d
SHA1 7702091bf33e1bcfa4d1003244e63ef39ff7faa6
SHA512 e29e0ad3a9228c15d8f987af62200e7d8f5ec802158ecf7f6c62fe9a46a3843cad4fe0ee8aa3c69facf6785ba9a0bbec8ddce06b252623c3f6c719ee9392fd0c
SSDEEP 768:24iWi9dJ7yZ9yHJGEfSKvr8WG7H7gor+ZlqiIyYbd+E23zNdoTA2/2HT:2zW4eyHJrfS//goCPZT3z/V2OHT
TLSH
T14E337E43ED5200B7E0270178941B9B6716B76D12051BBFDAAF80DDC5EC729BAECB0267
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Windows executables referencing non-Windows User-Agents
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

37823

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle WriteFile CreateFileA GetTickCount lstrcpyA lstrcatA GetSystemDirectoryA ExitThread Sleep TerminateProcess CreateProcessA DeleteFileA WinExec GetLocalTime CopyFileA lstrcmpA GetProcAddress LoadLibraryA GetModuleFileNameA GetVolumeInformationA GetDriveTypeA GetLogicalDrives SetFileAttributesA MoveFileA GetFileAttributesA CreateDirectoryA lstrcmpiA Process32Next Process32First CreateToolhelp32Snapshot CreateThread GetLastError GetTempPathA ReleaseMutex OpenMutexA GetCurrentProcess WaitForSingleObject ExitProcess CreateMutexA EndUpdateResourceA UpdateResourceA BeginUpdateResourceA ReadFile GetFileSize WritePrivateProfileStringA DuplicateHandle OpenProcess GetModuleHandleA GetCurrentThreadId lstrlenA GlobalMemoryStatusEx GetLocaleInfoW RaiseException InterlockedExchange LocalAlloc FreeLibrary GetStartupInfoA

msvcrt

time fclose fputs ??2@YAPAXI@Z atoi strncpy strcspn exit system ??3@YAXPAX@Z _beginthread strncmp _except_handler3 _exit _XcptFilter _acmdln __getmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _controlfp srand fopen strstr malloc sprintf rand _strcmpi

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_37c263f9ef0fa68e67a2a1a2064c616d_elex_gh0st-rat_remcos_wannacry

kernel32

msvcrt

generic