2026-10-26_e8df8b383b783780ed073bffbb813805_elex_gh0st-rat_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_e8df8b383b783780ed073bffbb813805_elex_gh0st-rat_wannacry
Size 804KB
Sample261027-eahc4sx13n
SHA256 5ad14998cc692b821c8bc7c3161aa37310220eb77910c298764e0ce8060f1194
MD5 e8df8b383b783780ed073bffbb813805
SHA1 d72463bf98cd677da5ab78125a80e1494b307d45
SHA512 b8d73041d5c3a68140bbd3e33ae80b9014c6eca7c79e8b50c2d9740e08e021dfa2e46487851acab74485e8ba535a79ba528bf4aff8f3bc978db1a35102805141
SSDEEP 24576:wXe0DnG/AelcAU1QEjsl4KOiG60kX5uM:n0DG/fcAZl4KO/a/
TLSH
T16B0523B4B9E11CF1EF08BEB31D692FB2D4777AF06318024799A4C8798076B149E563C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_e8df8b383b783780ed073bffbb813805_elex_gh0st-rat_wannacry

File Explorer

2026-10-26_e8df8b383b783780ed073bffbb813805_elex_gh0st-rat_wannacry

.exe 804KB

2026-10-26_e8df8b383b783780ed073bffbb813805_elex_gh0st-rat_wannacry

IMPHASH 44c0ba5f1c26a3125a877a56916f0f85
SHA256 5ad14998cc692b821c8bc7c3161aa37310220eb77910c298764e0ce8060f1194
MD5 e8df8b383b783780ed073bffbb813805
SHA1 d72463bf98cd677da5ab78125a80e1494b307d45
SHA512 b8d73041d5c3a68140bbd3e33ae80b9014c6eca7c79e8b50c2d9740e08e021dfa2e46487851acab74485e8ba535a79ba528bf4aff8f3bc978db1a35102805141
SSDEEP 24576:wXe0DnG/AelcAU1QEjsl4KOiG60kX5uM:n0DG/fcAZl4KO/a/
TLSH
T16B0523B4B9E11CF1EF08BEB31D692FB2D4777AF06318024799A4C8798076B149E563C9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16806

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mpr

WNetEnumResourceA WNetCloseEnum WNetOpenEnumA WNetUseConnectionA

kernel32

GlobalAlloc GetLogicalDrives IsBadWritePtr ExpandEnvironmentStringsA GetModuleFileNameA SetLastError GlobalFree GetSystemDirectoryA GetVersion GetModuleHandleA LoadLibraryA GetVersionExA GetCommandLineA RaiseException InterlockedExchange LocalAlloc FreeLibrary GetWindowsDirectoryA GetStartupInfoA GetLastError GetProcAddress

user32

wsprintfA CharNextA

advapi32

RegCloseKey RegSetValueExA RegOpenKeyExA RegQueryInfoKeyA RegQueryValueExA RegEnumKeyExA RegCreateKeyExA

msvcp60

?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z ?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z ??0Init@ios_base@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ?pubseekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@V32@H@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z ??1ios_base@std@@UAE@XZ ??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@ ?_Init@?$basic_filebuf@DU?$char_traits@D@std@@@std@@IAEXPAU_iobuf@@W4_Initfl@12@@Z ?getline@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@1@AAV21@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z ?pubseekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@JW4seekdir@ios_base@2@H@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_fstream@DU?$char_traits@D@std@@@std@@UAE@XZ ?close@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@XZ ?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z ?clear@ios_base@std@@QAEXH_N@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?open@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@PBDH@Z ??_7?$basic_fstream@DU?$char_traits@D@std@@@std@@6B@ ??0?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAE@PAU_iobuf@@@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ??_8?$basic_fstream@DU?$char_traits@D@std@@@std@@7B?$basic_ostream@DU?$char_traits@D@std@@@1@@ ??_8?$basic_fstream@DU?$char_traits@D@std@@@std@@7B?$basic_istream@DU?$char_traits@D@std@@@1@@ ??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@XZ ?_Fpz@std@@3_JB ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ?_Xlen@std@@YAXXZ ?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIPBDI@Z

msvcrt

_ismbcspace fclose _mbsicmp _mbsdec fflush vfprintf _strtime _strdate fopen _purecall _mbsnbcat free _exit _XcptFilter exit _acmdln __getmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _except_handler3 __dllonexit _onexit ?terminate@@YAXXZ _controlfp toupper ??2@YAPAXI@Z __CxxFrameHandler _mbsnbcpy memchr _mbsnbicmp _mbscmp

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_e8df8b383b783780ed073bffbb813805_elex_gh0st-rat_wannacry

mpr

kernel32

user32

advapi32

msvcp60

msvcrt

generic