2026-09-25_6b1bb0776f03e64c02cbbcae27b69c6e_elex_remcos_wannacry
Storm DDoS malware dropper
Resource dropper persists a service and injects a DLL remotelyStormAttack DDoS component identity
SHA-256e6e08b2ef1dbcdeeea58e99b6f29cb972ec6b56e27293e16c4bc0b12b51f3467
Evidence
⋯6 more rows
0x2fec00000000000000000000000000000000................
0x2ffc000000004d5ede771b76dd778378dd77....M^.w.v.w.x.w
0x300c397de377bbd5df775309df7793b1de779}.w...wS..w...w
0x301c1bc4df77e5eddd77e7ebdd77f06bdd77...w...w...w.k.w
0x302c8cb8de777170e377a7adde773832df77...wqp.w...w82.w
0x303c00000000b98f837c29c7807c6a48817c.......|)..|jH.|
0x304c871f827c57b3807c3103917c04000000...|W..|1..|....
0x305c00000000000000000000000000000000................
0x306c0000000000000000000000007b334430............{3D0
0x307c36343630462d334435332d346631632d6460F-3D53-4f1c-
0x308c424332342d3530303031304442314631BC24-500010DB1F1
0x309c457d007ce0c6807ca29a807c0f22807cE}.|...|...|.".|
0x30ac29b5807c28ac807c2606817cc928827c)..|(..|&..|.(.|
0x30bc634c817c9f0f817c0000000063bdde73cL.|...|....c..s
0x30cc0927dd733d49dd739143dd733a43dd73.'.s=I.s.C.s:C.s
0x30dc000000001a1c0876db17087607170876.......v...v...v
0x30ec11200876000000002feec4777c53c377. .v..../..w|S.w
0x30fcfa27c27776fac3771bc2c2773b17c477.'.wv..w...w;..w
0x310cb10ac477fb11c47707c4c2777415c477...w...w...wt..w
0x311c9c13c47710f0c3777e9ec377607cc477...w...w~..w`|.w
0x312c507ac477945cc377514ec377f84dc377Pz.w.\.wQN.w.M.w
⋯11 more rows
⋯5 more rows
0x34ea696e646f77734469726563746f727941indowsDirectoryA
0x34fa0000640043726561746552656d6f7465..d.CreateRemote
0x350a5468726561640000980147657450726fThread....GetPro
0x351a6341646472657373000077014765744dcAddress..w.GetM
0x352a6f64756c6548616e646c65410000a003oduleHandleA....
0x353a577269746550726f636573734d656d6fWriteProcessMemo
0x354a7279000076035669727475616c416c6cry..v.VirtualAll
0x355a6f6345780000bf036c7374726c656e41ocEx....lstrlenA
0x356a0000600043726561746550726f636573..`.CreateProces
⋯8 more rows
0x35fa6c737472636174410000b9036c737472lstrcatA....lstr
0x360a6370794100005001476574456e766972cpyA..P.GetEnvir
0x361a6f6e6d656e745661726961626c654100onmentVariableA.
0x362aad0147657453686f7274506174684e61..GetShortPathNa
⋯22 more rows
⋯7 more rows
0x401000000000000000000000000000000000................
0x402053746f726d5365727665722e646c6c00StormServer.dll.
0x403000000000000000000000000000000000................
0x404000000000000000000000000000000000................
0x405000000000000000000000000000000000................
⋯11 more rows
0x411000000000000000000000000000000000................
0x4120030000000000000053746f726d206464........Storm dd
0x41306f732053657276657200000000000000os Server.......
0x4140000000000000000057656c636f6d6520........Welcome
0x4150746f207573652073746f726d2064646fto use storm ddo
0x416073000000000000000000000000000000s...............
0x417000000000000000000000000000000000................
0x418000000000000000000000000000000000................
0x419000000000000000000000000000000000................
0x41a000000000000000000000000000000000................
⋯7 more rows
⋯5 more rows
0x42f063616c632e657865000000006e6f7465calc.exe....note
0x43007061642e65786500696578706c6f7265pad.exe.iexplore
0x43102e657865000000004b65726e656c3332.exe....Kernel32
0x4320000000004c6f61644c69627261727941....LoadLibraryA
0x43300000000053657276696365444c4c0000....ServiceDLL..
0x434053595354454d5c43757272656e74436fSYSTEM\CurrentCo
0x43506e74726f6c5365745c53657276696365ntrolSet\Service
0x4360735c4c616e6d616e5365727665725c50s\LanmanServer\P
0x43706172616d657465727300000025537973arameters...%Sys
0x438074656d526f6f74255c53797374656d33temRoot%\System3
0x4390325c0000203e206e756c0000202f63202\.. > nul.. /c
0x43a02064656c20000000434f4d5350454300 del ...COMSPEC.
0x43b0444c4c007b253038582d253034582d25DLL.{%08X-%04X-%
0x43c03034782d25303258253032582d25303204x-%02X%02X-%02
0x43d058253032582530325825303258253032X%02X%02X%02X%02
0x43e058253032587d00007762000072620000X%02X}..wb..rb..
0x43f0737475627061746800000000534f4654stubpath....SOFT
0x4400574152455c4d6963726f736f66745c41WARE\Microsoft\A
0x441063746976652053657475705c496e7374ctive Setup\Inst
0x4420616c6c656420436f6d706f6e656e7473alled Components
0x44305c0000002e6578650000000044657363\....exe....Desc
0x444072697074696f6e0053595354454d5c43ription.SYSTEM\C
0x4450757272656e74436f6e74726f6c536574urrentControlSet
0x44605c53657276696365735c00002e455845\Services\...EXE
0x447000000000000000000000000000000000................
⋯11 more rows
0x5914737c2573000000002575204d42000000s|%s....%u MB...
0x59242575204742000000476c6f62616c4d65%u GB...GlobalMe
0x59346d6f7279537461747573457800000000moryStatusEx....
0x59446b65726e656c33322e646c6c00000000kernel32.dll....
0x59547e2575204d487a007e4d487a00000000~%u MHz.~MHz....
0x596448415244574152455c44455343524950HARDWARE\DESCRIP
0x597454494f4e5c53797374656d5c43656e74TION\System\Cent
0x598472616c50726f636573736f725c300000ralProcessor\0..
0x599457696e370000000057696e5669737461Win7....WinVista
0x59a40000000057696e324b33000057696e58....Win2K3..WinX
0x59b45000000057696e324b00000057696e4eP...Win2K...WinN
0x59c454000000d7a8d2b5b0e6000025252563T...........%%%c
0x59d425632525256325630000000025630000%c%%%c%c....%c..
0x59e42b000000736574736f636b6f70742045+...setsockopt E
0x59f472726f72210a000025642e25642e2564rror!...%d.%d.%d
0x5a042e256400e2bac9c869e4912eeaf52eed.%d.....i.......
0x5a14c093a663352efe83dd4666ab702e85c3...c5....Ff.p...
0x5a2433e1368d55d9972e000000006266796c3.6.U.......bfyl
0x5a34000000003139322e3136382e312e3234....192.168.1.24
0x5a44340000004745542000000000204854544...GET .... HTT
0x5a54502f312e310d0a004163636570743a20P/1.1...Accept:
0x5a64696d6167652f6769662c20696d616765image/gif, image
0x5a742f782d786269746d61702c20696d6167/x-xbitmap, imag
0x5a84652f6a7065672c20696d6167652f706ae/jpeg, image/pj
0x5a947065672c206170706c69636174696f6epeg, application
0x5aa42f782d73686f636b776176652d666c61/x-shockwave-fla
0x5ab473682c206170706c69636174696f6e2fsh, application/
0x5ac4766e642e6d732d657863656c2c206170vnd.ms-excel, ap
0x5ad4706c69636174696f6e2f766e642e6d73plication/vnd.ms
0x5ae42d706f776572706f696e742c20617070-powerpoint, app
0x5af46c69636174696f6e2f6d73776f72642clication/msword,
0x5b04202a2f2a0d0a00004163636570742d4c */*....Accept-L
0x5b14616e67756167653a207a682d636e0d0aanguage: zh-cn..
0x5b24000000004163636570742d456e636f64....Accept-Encod
0x5b34696e673a20677a69702c206465666c61ing: gzip, defla
0x5b44746500000d0a557365722d4167656e74te....User-Agent
0x5b543a4d6f7a696c6c612f342e302028636f:Mozilla/4.0 (co
0x5b646d70617469626c653b204d5349452036mpatible; MSIE 6
0x5b742e303b2057696e646f7773204e542035.0; Windows NT 5
0x5b842e313b2053563129000000000d0a486f.1; SV1)......Ho
0x5b9473743a000d0a436f6e6e656374696f6est:...Connection
0x5ba43a204b6565702d416c69766500000000: Keep-Alive....
0x5bb40d0a0d0a000000002f00000020485454......../... HTT
0x5bc4502f312e310d0a436f6e74656e742d54P/1.1..Content-T
0x5bd47970653a20746578742f68746d6c0000ype: text/html..
0x5be40d0a486f73743a20000000000d0a4163..Host: ......Ac
0x5bf4636570743a20746578742f68746d6c2ccept: text/html,
0x5c04202a2f2a000000000d0a557365722d41 */*......User-A