General
- Target 2026-09-29_3ef74ef1bf259e2bd6461a5c0347fc9f_elex_gh0st-rat_remcos_wannacry
- Size 50KB
- Sample260930-1pe27ayvbv
- SHA256 204f1942751e490fb4d9ad7b089b1b59164e95468727412b20edca2142b63e8c
- MD5 3ef74ef1bf259e2bd6461a5c0347fc9f
- SHA1 1e7e0bfca1b40eb45260966655870c799c78b996
- SHA512 ad4ca2a10eb213ca021ff3bbea8b912a061d5561132c4e1dc84032786a69f18c8322c48afb4e3af9eeefde0f821eec478f6b23d27b80e33a04d85f8e2fc8db79
- SSDEEP 768:24iWi9dJ7yZ9yHJGEfSKvr8WG7H7gor+ZlqiIyYb8+E23zNdoTA2D2HT:2zW4eyHJrfS//goCPZ+3z/V2CHT
- TLSH T1D7337E43ED5200B7E0270178941B9B6716B76D12051BBFDAAF80DDC5EC729BAECB0267
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-09-29_3ef74ef1bf259e2bd6461a5c0347fc9f_elex_gh0st-rat_remcos_wannacry.exe
Resource
win10v2004-20260911-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-29_3ef74ef1bf259e2bd6461a5c0347fc9f_elex_gh0st-rat_remcos_wannacry.exe
Resource
win11ltsc2024-20260911-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-29_3ef74ef1bf259e2bd6461a5c0347fc9f_elex_gh0st-rat_remcos_wannacry
- Size 50KB
- SHA256 204f1942751e490fb4d9ad7b089b1b59164e95468727412b20edca2142b63e8c
- MD5 3ef74ef1bf259e2bd6461a5c0347fc9f
- SHA1 1e7e0bfca1b40eb45260966655870c799c78b996
- SHA512 ad4ca2a10eb213ca021ff3bbea8b912a061d5561132c4e1dc84032786a69f18c8322c48afb4e3af9eeefde0f821eec478f6b23d27b80e33a04d85f8e2fc8db79
- SSDEEP 768:24iWi9dJ7yZ9yHJGEfSKvr8WG7H7gor+ZlqiIyYb8+E23zNdoTA2D2HT:2zW4eyHJrfS//goCPZ+3z/V2CHT
- TLSH T1D7337E43ED5200B7E0270178941B9B6716B76D12051BBFDAAF80DDC5EC729BAECB0267
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects Windows executables referencing non-Windows User-Agents
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory