General
- Target 2026-10-13_d2cf76a2c0afcfe125fa9b7bf34abb48_elex_gh0st-rat_remcos_wannacry
- Size 50KB
- Sample261014-fxm3jsfz91
- SHA256 faec685b3091f3b4f5f750479e37b82409b6c49ddb560069ab5b9dc6f8eb5b02
- MD5 d2cf76a2c0afcfe125fa9b7bf34abb48
- SHA1 4f3f4a41c9329cd1f4154fb5397031a328bea355
- SHA512 7576e5a3e01f7e577e680046d5efeda57afb1472e90f115c5623b650840a33c5e3f1c974e59d313fc833694d6a40d3c327ad2160ba4eaf4afdda21458efaaad9
- SSDEEP 768:24iWi9dJ7yZ9yHJGEfSKvr8WG7H7gor+ZlqiIyYbd+E23zNdoTA2J2HT:2zW4eyHJrfS//goCPZT3z/V20HT
- TLSH T1D0337E43ED5200B7E0270178941B9B6716B76D12051BBFDAAF80DDC5EC729BAECB0267
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-10-13_d2cf76a2c0afcfe125fa9b7bf34abb48_elex_gh0st-rat_remcos_wannacry.exe
Resource
win10v2004-20260911-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-13_d2cf76a2c0afcfe125fa9b7bf34abb48_elex_gh0st-rat_remcos_wannacry.exe
Resource
win11ltsc2024-20260911-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-13_d2cf76a2c0afcfe125fa9b7bf34abb48_elex_gh0st-rat_remcos_wannacry
- Size 50KB
- SHA256 faec685b3091f3b4f5f750479e37b82409b6c49ddb560069ab5b9dc6f8eb5b02
- MD5 d2cf76a2c0afcfe125fa9b7bf34abb48
- SHA1 4f3f4a41c9329cd1f4154fb5397031a328bea355
- SHA512 7576e5a3e01f7e577e680046d5efeda57afb1472e90f115c5623b650840a33c5e3f1c974e59d313fc833694d6a40d3c327ad2160ba4eaf4afdda21458efaaad9
- SSDEEP 768:24iWi9dJ7yZ9yHJGEfSKvr8WG7H7gor+ZlqiIyYbd+E23zNdoTA2J2HT:2zW4eyHJrfS//goCPZT3z/V20HT
- TLSH T1D0337E43ED5200B7E0270178941B9B6716B76D12051BBFDAAF80DDC5EC729BAECB0267
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects Windows executables referencing non-Windows User-Agents
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory