General
- Target 2026-07-21_0387e0b3b7b286c514f3f888b83e4a21_elex_emotet_icedid_krbanker_remcos_stop
- Size 1.5MB
- Sample260721-wepresyzaw
- SHA256 5d30328c602f769913d32ecd875ca7e6338f47c64084c0a3e372d7f58fd50764
- MD5 0387e0b3b7b286c514f3f888b83e4a21
- SHA1 a25c57f5f39927d40606ae8772b90c4bb7471da2
- SHA512 1eafc1ff754ac2a29a421def1eb1b35b37bf06dc82f63ec04b6942bc6bb7fbce540e7fd47b165862e6af53f2cebe22b0fc447a23e7bf5bc08f0388e277629aec
- SSDEEP 24576:0++ZwJfwCI8Ddfs/kMUftLGZ98FlE6wI+gfnlRIfaE3JRdh:01/kjtPlERDGnlRANRdh
- TLSH T19F757C23E691C0F1D11100B11AF5573DAA78BB774E359BA3EB92DEB45D212E2CE1720E
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-21_0387e0b3b7b286c514f3f888b83e4a21_elex_emotet_icedid_krbanker_remcos_stop.exe
Resource
win10v2004-20260513-en
19 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-21_0387e0b3b7b286c514f3f888b83e4a21_elex_emotet_icedid_krbanker_remcos_stop
- Size 1.5MB
- SHA256 5d30328c602f769913d32ecd875ca7e6338f47c64084c0a3e372d7f58fd50764
- MD5 0387e0b3b7b286c514f3f888b83e4a21
- SHA1 a25c57f5f39927d40606ae8772b90c4bb7471da2
- SHA512 1eafc1ff754ac2a29a421def1eb1b35b37bf06dc82f63ec04b6942bc6bb7fbce540e7fd47b165862e6af53f2cebe22b0fc447a23e7bf5bc08f0388e277629aec
- SSDEEP 24576:0++ZwJfwCI8Ddfs/kMUftLGZ98FlE6wI+gfnlRIfaE3JRdh:01/kjtPlERDGnlRANRdh
- TLSH T19F757C23E691C0F1D11100B11AF5573DAA78BB774E359BA3EB92DEB45D212E2CE1720E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.