General
- Target 2026-09-29_a06dcdad644bd33d47f0e3369d8cf076_elex_gh0st-rat_remcos_wannacry
- Size 50KB
- Sample260930-wmmxssty3n
- SHA256 e89b03da722e18c53ee817d1e8575f00d0677a703a0217c85c3499c9b0adb2d8
- MD5 a06dcdad644bd33d47f0e3369d8cf076
- SHA1 3041c47474173291cf421a2c7c952efe71bdd910
- SHA512 aac8fc01c3ebc44a1910738e3f24cec67b9f4373d183013417d43e6904c2fb7f1abbee70f473cdd2adc58087900bb6db868fb950250c53cfa2dabe699ccf0c9b
- SSDEEP 768:24iWi9dJ7yZ9yHJGEfSKvr8WG7H7gor+ZlqiIyYb8+E23zNdoTA2h2HT:2zW4eyHJrfS//goCPZ+3z/V2sHT
- TLSH T18B337E43ED5200B7E0270178941B9B6716B76D12051BBFDAAF80DDC5EC729BAECB0267
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-09-29_a06dcdad644bd33d47f0e3369d8cf076_elex_gh0st-rat_remcos_wannacry.exe
Resource
win10v2004-20260911-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-29_a06dcdad644bd33d47f0e3369d8cf076_elex_gh0st-rat_remcos_wannacry.exe
Resource
win11ltsc2024-20260911-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-29_a06dcdad644bd33d47f0e3369d8cf076_elex_gh0st-rat_remcos_wannacry
- Size 50KB
- SHA256 e89b03da722e18c53ee817d1e8575f00d0677a703a0217c85c3499c9b0adb2d8
- MD5 a06dcdad644bd33d47f0e3369d8cf076
- SHA1 3041c47474173291cf421a2c7c952efe71bdd910
- SHA512 aac8fc01c3ebc44a1910738e3f24cec67b9f4373d183013417d43e6904c2fb7f1abbee70f473cdd2adc58087900bb6db868fb950250c53cfa2dabe699ccf0c9b
- SSDEEP 768:24iWi9dJ7yZ9yHJGEfSKvr8WG7H7gor+ZlqiIyYb8+E23zNdoTA2h2HT:2zW4eyHJrfS//goCPZ+3z/V2sHT
- TLSH T18B337E43ED5200B7E0270178941B9B6716B76D12051BBFDAAF80DDC5EC729BAECB0267
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects Windows executables referencing non-Windows User-Agents
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory