General
- Target 2026-10-22_374762d91953b353d406b8a2cf39c87b_elex_gh0st-rat_remcos_scribble_strictor_virut_wannacry
- Size 121KB
- Sample261024-t77ftsvzaz
- SHA256 e6183f2db60f4141967b7a5cadd0554601d3c4b406f2e29b252bbc5730f8f698
- MD5 374762d91953b353d406b8a2cf39c87b
- SHA1 17fcc6502b12235e8ba545668bbe63cc7261c1e3
- SHA512 497f4f29b8be9afc14839992ef104f891ec1a87c52f697cef7ad1056f8ec5fca89ad54a117765c15de8e85c4cee2b61fef18915290b112541757fbe76159ccc8
- SSDEEP 3072:yxeQ+IMWqyzv9Bv0jRK/MgyjrbJrmd9F+rZ2LpLvuhyi13n:zQ7tqyzvTsMk3LJrmdqd2Lpq113n
- TLSH T195C3F157FD4250F2E4160478792EABBB197B1C314E1EA296DF40DC9C6CF6205FA392C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-10-22_374762d91953b353d406b8a2cf39c87b_elex_gh0st-rat_remcos_scribble_strictor_virut_wannacry.exe
Resource
win10v2004-20260911-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_374762d91953b353d406b8a2cf39c87b_elex_gh0st-rat_remcos_scribble_strictor_virut_wannacry.exe
Resource
win11ltsc2024-20260911-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-22_374762d91953b353d406b8a2cf39c87b_elex_gh0st-rat_remcos_scribble_strictor_virut_wannacry
- Size 121KB
- SHA256 e6183f2db60f4141967b7a5cadd0554601d3c4b406f2e29b252bbc5730f8f698
- MD5 374762d91953b353d406b8a2cf39c87b
- SHA1 17fcc6502b12235e8ba545668bbe63cc7261c1e3
- SHA512 497f4f29b8be9afc14839992ef104f891ec1a87c52f697cef7ad1056f8ec5fca89ad54a117765c15de8e85c4cee2b61fef18915290b112541757fbe76159ccc8
- SSDEEP 3072:yxeQ+IMWqyzv9Bv0jRK/MgyjrbJrmd9F+rZ2LpLvuhyi13n:zQ7tqyzvTsMk3LJrmdqd2Lpq113n
- TLSH T195C3F157FD4250F2E4160478792EABBB197B1C314E1EA296DF40DC9C6CF6205FA392C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies firewall policy service
-
Detects Windows executables referencing non-Windows User-Agents
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Create or Modify System Process
1Windows Service
1Process Injection
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Process Injection
1