2026-10-17_a77e2ac723409650fcc29caa9166995d_elex_remcos_scribble_strictor_virut_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-17_a77e2ac723409650fcc29caa9166995d_elex_remcos_scribble_strictor_virut_wannacry
Size 665KB
Sample261018-15aseabs5v
SHA256 b699d3a9679c722d95e4619d26a434bd518eb9c5b442d2eeea8c72efd37a2d7b
MD5 a77e2ac723409650fcc29caa9166995d
SHA1 b746d1f7fd768c74cd387bfdca12067a828760e1
SHA512 7280849b7f72e1aaad247619829a25affe61068304715d1362e514585b202d8460ba5526bbc73342953f2fdbabcef2cc3176cf8aeabc3829161d92483b5646ad
SSDEEP 12288:vbc1yrrt6rrrrrrrrrrrrrrrrSDmrSgSxcgozKVpaHl5q6e11VFuFJPpuPyB+uuv:vY1yrrt6rrrrrrrrrrrrrrrrSfXoz0Yw
TLSH
T1F1E423A775E6E0B2C9A810360962D3F7DB370C761E29D361BBA6CDC19830660B572F0D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Custom signature

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-17_a77e2ac723409650fcc29caa9166995d_elex_remcos_scribble_strictor_virut_wannacry

File Explorer

2026-10-17_a77e2ac723409650fcc29caa9166995d_elex_remcos_scribble_strictor_virut_wannacry

.exe 665KB

2026-10-17_a77e2ac723409650fcc29caa9166995d_elex_remcos_scribble_strictor_virut_wannacry

IMPHASH fff0da421b27b323c57f2057dcfa06b1
SHA256 b699d3a9679c722d95e4619d26a434bd518eb9c5b442d2eeea8c72efd37a2d7b
MD5 a77e2ac723409650fcc29caa9166995d
SHA1 b746d1f7fd768c74cd387bfdca12067a828760e1
SHA512 7280849b7f72e1aaad247619829a25affe61068304715d1362e514585b202d8460ba5526bbc73342953f2fdbabcef2cc3176cf8aeabc3829161d92483b5646ad
SSDEEP 12288:vbc1yrrt6rrrrrrrrrrrrrrrrSDmrSgSxcgozKVpaHl5q6e11VFuFJPpuPyB+uuv:vY1yrrt6rrrrrrrrrrrrrrrrSfXoz0Yw
TLSH
T1F1E423A775E6E0B2C9A810360962D3F7DB370C761E29D361BBA6CDC19830660B572F0D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Windows executables referencing non-Windows User-Agents
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

680436

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mfc42

ord6376 ord3749 ord5065 ord1727 ord5261 ord2446 ord2124 ord5277 ord4627 ord4425 ord2055 ord1146 ord1168 ord324 ord4234 ord6197 ord4710 ord2379 ord755 ord470 ord2648 ord4441 ord4837 ord3798 ord5280 ord4353 ord6374 ord5163 ord2385 ord5241 ord4407 ord1775 ord4078 ord6052 ord4998 ord4853 ord4376 ord5265 ord1134 ord2514 ord1576 ord641 ord815 ord825 ord561 ord3738 ord4424 ord4622 ord4080 ord3079 ord3825 ord3831 ord3830 ord2976 ord3081 ord2985 ord3262 ord3136 ord4465 ord3259 ord3147 ord2982 ord5714 ord5289 ord5307 ord4698 ord4079 ord2725 ord5302 ord5300 ord3346 ord2396 ord5199 ord1089 ord3922 ord5731 ord2512 ord2554 ord4486 ord6375 ord4274 ord3597 ord4673

msvcrt

_controlfp __set_app_type __p__fmode __CxxFrameHandler atoi strncpy _setmbcp malloc sprintf rand strcspn strstr strncmp __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit _onexit __dllonexit _except_handler3

kernel32

EndUpdateResourceA EnumResourceNamesA FindResourceA SizeofResource LoadResource LockResource WriteFile GetTempPathA MoveFileExA CloseHandle CreateFileA lstrcpynA lstrlenA UpdateResourceA GetLastError ReleaseMutex lstrcatA WinExec ExitProcess LoadLibraryA FreeLibrary DeleteFileA GetProcAddress Sleep CreateThread GetModuleHandleA GetStartupInfoA BeginUpdateResourceA GlobalFree ReadFile GlobalAlloc GetFileSize GetFileAttributesA lstrcpyA WaitForSingleObject CreateMutexA CopyFileA GetSystemDirectoryA GetTickCount GlobalMemoryStatusEx OpenMutexA GetLocaleInfoW ExitThread TerminateProcess CreateProcessA GetComputerNameA

user32

IsIconic EnableWindow GetSystemMetrics LoadIconA wsprintfA GetDesktopWindow SetWindowLongA SendMessageA DrawIcon GetClientRect

advapi32

StartServiceA RegOpenKeyA RegSetValueExA CloseServiceHandle StartServiceCtrlDispatcherA RegisterServiceCtrlHandlerA SetServiceStatus RegOpenKeyExA RegQueryValueExA RegCloseKey OpenSCManagerA OpenServiceA DeleteService CreateServiceA

shell32

ShellExecuteA

ws2_32

send getpeername select __WSAFDIsSet recv ntohs setsockopt WSAIoctl htons socket connect closesocket gethostbyname inet_addr sendto WSASocketA htonl WSAStartup

winmm

timeGetTime

Name

.text

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

bwusmhl

Size

31KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

ivdkbuk

Size

28KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

twaxydz

Size

31KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

xhateqx

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

fiolebz

Size

31KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

flbtnrp

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

mrfqvpe

Size

31KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

mapuiis

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

fudkyrf

Size

368KB

Virtual Size

372KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-17_a77e2ac723409650fcc29caa9166995d_elex_remcos_scribble_strictor_virut_wannacry

mfc42

msvcrt

kernel32

user32

advapi32

shell32

ws2_32

winmm

generic