General
- Target 2026-07-02_e2164b088c75890ca418589a5504d038_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop
- Size 449KB
- Sample260702-2cca7sfx4y
- SHA256 946ef214479682b336fff3176e1ff6e9ce6e2b7c0cadefdb6fdbc27e47b6a1cb
- MD5 e2164b088c75890ca418589a5504d038
- SHA1 ff8499a461713fe5b05605474c253c6c5ca651a8
- SHA512 d8b423cceb89bd221725be91905d7d684b8714253c773eb56aced41eb7bb16dc72b04b7f976960e0e990093bfb8dd2bcb948d5be3efecff33244cc9723d95d70
- SSDEEP 6144:nesmzyHFkzaR+lDAAJq+SbXdE7ItTZA3s0bxMt:nGyHm1dAAJybXdE7IlZ8s0qt
- TLSH T1DCA429E66710C0B5CBC35978D8379D6F9533654E8C6A268F3685FF5A3E32345402B88B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-02_e2164b088c75890ca418589a5504d038_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-02_e2164b088c75890ca418589a5504d038_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
Resource
win11ltsc2024-20260630-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-02_e2164b088c75890ca418589a5504d038_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop
- Size 449KB
- SHA256 946ef214479682b336fff3176e1ff6e9ce6e2b7c0cadefdb6fdbc27e47b6a1cb
- MD5 e2164b088c75890ca418589a5504d038
- SHA1 ff8499a461713fe5b05605474c253c6c5ca651a8
- SHA512 d8b423cceb89bd221725be91905d7d684b8714253c773eb56aced41eb7bb16dc72b04b7f976960e0e990093bfb8dd2bcb948d5be3efecff33244cc9723d95d70
- SSDEEP 6144:nesmzyHFkzaR+lDAAJq+SbXdE7ItTZA3s0bxMt:nGyHm1dAAJybXdE7IlZ8s0qt
- TLSH T1DCA429E66710C0B5CBC35978D8379D6F9533654E8C6A268F3685FF5A3E32345402B88B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies visibility of hidden/system files in Explorer
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext