General
- Target 2026-07-15_82f0e38a0f358bcd0081c56b36561596_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop
- Size 449KB
- Sample260715-ls9cwagy9n
- SHA256 52704bad91e1e43b4213881a1e84a0dbb8f4d3b0655576f50de5ee73c95fb66b
- MD5 82f0e38a0f358bcd0081c56b36561596
- SHA1 c486d6a9f17dd02f3a73629ee16511e1f79368ae
- SHA512 0efc8d18b4aa8326f28627e98a9caf408de95349ecf985aab041dd302cf86206c86fe0e95821a131f46e3a7b2fcf0d42bd80e39244026baffc8e5793069b6c3c
- SSDEEP 6144:nesmzyHFkzaR+lDAAJq+SbXdE7ItTZA3s0bxMr:nGyHm1dAAJybXdE7IlZ8s0qr
- TLSH T111A419E0231580B4DB93597DC43B8E6F6433B50DAD69514E3A8ABF5B3E7630241738AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-15_82f0e38a0f358bcd0081c56b36561596_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-15_82f0e38a0f358bcd0081c56b36561596_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-15_82f0e38a0f358bcd0081c56b36561596_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop
- Size 449KB
- SHA256 52704bad91e1e43b4213881a1e84a0dbb8f4d3b0655576f50de5ee73c95fb66b
- MD5 82f0e38a0f358bcd0081c56b36561596
- SHA1 c486d6a9f17dd02f3a73629ee16511e1f79368ae
- SHA512 0efc8d18b4aa8326f28627e98a9caf408de95349ecf985aab041dd302cf86206c86fe0e95821a131f46e3a7b2fcf0d42bd80e39244026baffc8e5793069b6c3c
- SSDEEP 6144:nesmzyHFkzaR+lDAAJq+SbXdE7ItTZA3s0bxMr:nGyHm1dAAJybXdE7IlZ8s0qr
- TLSH T111A419E0231580B4DB93597DC43B8E6F6433B50DAD69514E3A8ABF5B3E7630241738AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies visibility of hidden/system files in Explorer
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext