2026-10-22_52627d923ed9ede8e1c47754cf7d208a_elex_remcos_wannacry

General

Target
2026-10-22_52627d923ed9ede8e1c47754cf7d208a_elex_remcos_wannacry
Size 84KB
Sample261024-qkalssh17s
SHA256 59892dda5c4997e7f3eed4b543d4ecacb72d8a7235566add568a19e8aa081461
MD5 52627d923ed9ede8e1c47754cf7d208a
SHA1 7789f715b0ce2cc8c9d3440b812f3a5d67e53a04
SHA512 2b083a9c226254b7a681ba0ed566b5c8fcc1e7f02a9c04daeae827aaf51387d162fc6356abe494d63eedd47d43ff46c7bf37482243f2d361639c01575f94ff33
SSDEEP 768:rvw9816vhKQLropGR4/QQlm2iaQcpFTXNvgDao4QTTyS1tl7lfqvocqcdwV9:7EGh0opGRF9zaQcpLgDaoNnyS1loLwL
TLSH
T1BE835B03A684B9F2EB680135B19F0F7E563796B1C0C9682F5B638DB55862863F431E13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_52627d923ed9ede8e1c47754cf7d208a_elex_remcos_wannacry

SHA256 59892dda5c4997e7f3eed4b543d4ecacb72d8a7235566add568a19e8aa081461
MD5 52627d923ed9ede8e1c47754cf7d208a
SHA1 7789f715b0ce2cc8c9d3440b812f3a5d67e53a04
SHA512 2b083a9c226254b7a681ba0ed566b5c8fcc1e7f02a9c04daeae827aaf51387d162fc6356abe494d63eedd47d43ff46c7bf37482243f2d361639c01575f94ff33
SSDEEP 768:rvw9816vhKQLropGR4/QQlm2iaQcpFTXNvgDao4QTTyS1tl7lfqvocqcdwV9:7EGh0opGRF9zaQcpLgDaoNnyS1loLwL
TLSH
T1BE835B03A684B9F2EB680135B19F0F7E563796B1C0C9682F5B638DB55862863F431E13
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

9844

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths