General
- Target 2026-06-27_acf3d20ecad446dc241e37b185cf30e5_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop
- Size 449KB
- Sample260629-ej8xescw9z
- SHA256 c2d6ea7406b95a353d70797ac4967ec219191ade0f9e8be5be79943b7490be14
- MD5 acf3d20ecad446dc241e37b185cf30e5
- SHA1 0330856229c1520cbfc7320fb7259fc417876b56
- SHA512 8f2f7db6e93f5ec7ca38e611032002823fc1f02630aa12ba45d4463a7ef57f038d0bcdfce2fd3c9cc6146907504c0e86547a350922c948158ee4cd550c8c2679
- SSDEEP 6144:nesmzyHFkzaR+lDAAJq+SbXdE7ItTZA3s0bxMs:nGyHm1dAAJybXdE7IlZ8s0qs
- TLSH T150A4F8E47742C0A9DB9B8174E4378E9F9872E40D6D6A429E3AC1BF5E3D31382811794F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-27_acf3d20ecad446dc241e37b185cf30e5_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-27_acf3d20ecad446dc241e37b185cf30e5_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
Resource
win11ltsc2024-20260618-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-27_acf3d20ecad446dc241e37b185cf30e5_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop
- Size 449KB
- SHA256 c2d6ea7406b95a353d70797ac4967ec219191ade0f9e8be5be79943b7490be14
- MD5 acf3d20ecad446dc241e37b185cf30e5
- SHA1 0330856229c1520cbfc7320fb7259fc417876b56
- SHA512 8f2f7db6e93f5ec7ca38e611032002823fc1f02630aa12ba45d4463a7ef57f038d0bcdfce2fd3c9cc6146907504c0e86547a350922c948158ee4cd550c8c2679
- SSDEEP 6144:nesmzyHFkzaR+lDAAJq+SbXdE7ItTZA3s0bxMs:nGyHm1dAAJybXdE7IlZ8s0qs
- TLSH T150A4F8E47742C0A9DB9B8174E4378E9F9872E40D6D6A429E3AC1BF5E3D31382811794F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies visibility of hidden/system files in Explorer
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext