General
- Target 2026-11-01_a341ac68d8931a26d6e0415e67c5f943_elex_gh0st-rat_remcos_scribble_strictor_virut_wannacry
- Size 65KB
- Sample261102-p75vsatwhs
- SHA256 1fdc54a497b7af9d1c1dd70fd0d81ab94d1c771167f0dd6fbe269bd463877092
- MD5 a341ac68d8931a26d6e0415e67c5f943
- SHA1 cf5dc5a655d3350305c09c51cb8314811f3fc4ef
- SHA512 8c31acf886248d4e1313d899053064cee12794b7df624a2d7d00143d345b69c17bea579b809a079a1e75c1403a146d68ad235288c9febdcf338edea6f8abd54d
- SSDEEP 1536:6rayLgKh8/HIYNcn0HUEdrPyzVmgSyluAXT9h6j7V+wFS:ikKh8/HIYNc0xdTyzV9S2uAXZQhO
- TLSH T1F553D083F9C594F2E4165034347FAB7972BB08700A3EA297EF00DD9D18B5A25FE76249
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-11-01_a341ac68d8931a26d6e0415e67c5f943_elex_gh0st-rat_remcos_scribble_strictor_virut_wannacry.exe
Resource
win10v2004-20260911-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-01_a341ac68d8931a26d6e0415e67c5f943_elex_gh0st-rat_remcos_scribble_strictor_virut_wannacry.exe
Resource
win11ltsc2024-20260911-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-11-01_a341ac68d8931a26d6e0415e67c5f943_elex_gh0st-rat_remcos_scribble_strictor_virut_wannacry
- Size 65KB
- SHA256 1fdc54a497b7af9d1c1dd70fd0d81ab94d1c771167f0dd6fbe269bd463877092
- MD5 a341ac68d8931a26d6e0415e67c5f943
- SHA1 cf5dc5a655d3350305c09c51cb8314811f3fc4ef
- SHA512 8c31acf886248d4e1313d899053064cee12794b7df624a2d7d00143d345b69c17bea579b809a079a1e75c1403a146d68ad235288c9febdcf338edea6f8abd54d
- SSDEEP 1536:6rayLgKh8/HIYNcn0HUEdrPyzVmgSyluAXT9h6j7V+wFS:ikKh8/HIYNc0xdTyzV9S2uAXZQhO
- TLSH T1F553D083F9C594F2E4165034347FAB7972BB08700A3EA297EF00DD9D18B5A25FE76249
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies firewall policy service
-
Detects Windows executables referencing non-Windows User-Agents
-
Drops file in Drivers directory
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Create or Modify System Process
1Windows Service
1Process Injection
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Process Injection
1