General
- Target 2026-07-28_a9f123221849f1c0d862c59aad6fb5ae_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop
- Size 449KB
- Sample260728-e6exvsyakf
- SHA256 5a66a4016547a695d719941d11414d65dbda4835e8bb0ca4137543576bfef303
- MD5 a9f123221849f1c0d862c59aad6fb5ae
- SHA1 954cf311e1e9c5fb26f2b61c05ac1c854f8a7a45
- SHA512 533089c3100c772285c897d3d5f1b74e827b70e1932088879369e4c9c41b0c83f5513933dfc5daeb82ea4c9724c21ce915c0e1cf80adae826328dc0a20b9978d
- SSDEEP 6144:nesmzyHFkzaR+lDAAJq+SbXdE7ItTZA3s0bxM7:nGyHm1dAAJybXdE7IlZ8s0q7
- TLSH T128A4F6E06741C0A1CBC355B5E8778EAF6033610D9D2A598E3A86BF3F3E76351461AC4B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-28_a9f123221849f1c0d862c59aad6fb5ae_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_a9f123221849f1c0d862c59aad6fb5ae_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-28_a9f123221849f1c0d862c59aad6fb5ae_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop
- Size 449KB
- SHA256 5a66a4016547a695d719941d11414d65dbda4835e8bb0ca4137543576bfef303
- MD5 a9f123221849f1c0d862c59aad6fb5ae
- SHA1 954cf311e1e9c5fb26f2b61c05ac1c854f8a7a45
- SHA512 533089c3100c772285c897d3d5f1b74e827b70e1932088879369e4c9c41b0c83f5513933dfc5daeb82ea4c9724c21ce915c0e1cf80adae826328dc0a20b9978d
- SSDEEP 6144:nesmzyHFkzaR+lDAAJq+SbXdE7ItTZA3s0bxM7:nGyHm1dAAJybXdE7IlZ8s0q7
- TLSH T128A4F6E06741C0A1CBC355B5E8778EAF6033610D9D2A598E3A86BF3F3E76351461AC4B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies visibility of hidden/system files in Explorer
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext