General
- Target 2026-07-28_9a7a3fd7391f4662a6aa38b3a45ef259_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop
- Size 449KB
- Sample260728-2dlahaxfpg
- SHA256 57fe1f230585619f8be2c8233ecf02b9c9f6c861ce174111298a3c3a2c02b0d0
- MD5 9a7a3fd7391f4662a6aa38b3a45ef259
- SHA1 04fa5d663610e65d9bae44e5b1ce33873d5847af
- SHA512 58d44fb0c63c5e8cd170a3b263e1b7a52c0aa0418c779ec69a608b6c97db1aa63029db57d1a52c91c95d5ff53632e64e809a1daef21d99690f3c93e915659fc8
- SSDEEP 6144:nesmzyHFkzaR+lDAAJq+SbXdE7ItTZA3s0bxMG:nGyHm1dAAJybXdE7IlZ8s0qG
- TLSH T170A409E13740C0A0DBAB4E79C43B5FAF1432654EED75560E31D9BF1B6D29381821ACAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-28_9a7a3fd7391f4662a6aa38b3a45ef259_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_9a7a3fd7391f4662a6aa38b3a45ef259_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-28_9a7a3fd7391f4662a6aa38b3a45ef259_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop
- Size 449KB
- SHA256 57fe1f230585619f8be2c8233ecf02b9c9f6c861ce174111298a3c3a2c02b0d0
- MD5 9a7a3fd7391f4662a6aa38b3a45ef259
- SHA1 04fa5d663610e65d9bae44e5b1ce33873d5847af
- SHA512 58d44fb0c63c5e8cd170a3b263e1b7a52c0aa0418c779ec69a608b6c97db1aa63029db57d1a52c91c95d5ff53632e64e809a1daef21d99690f3c93e915659fc8
- SSDEEP 6144:nesmzyHFkzaR+lDAAJq+SbXdE7ItTZA3s0bxMG:nGyHm1dAAJybXdE7IlZ8s0qG
- TLSH T170A409E13740C0A0DBAB4E79C43B5FAF1432654EED75560E31D9BF1B6D29381821ACAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies visibility of hidden/system files in Explorer
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext