2026-07-28_a9f123221849f1c0d862c59aad6fb5ae_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop

General

Target
2026-07-28_a9f123221849f1c0d862c59aad6fb5ae_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop
Size 449KB
Sample260728-e6exvsyakf
SHA256 5a66a4016547a695d719941d11414d65dbda4835e8bb0ca4137543576bfef303
MD5 a9f123221849f1c0d862c59aad6fb5ae
SHA1 954cf311e1e9c5fb26f2b61c05ac1c854f8a7a45
SHA512 533089c3100c772285c897d3d5f1b74e827b70e1932088879369e4c9c41b0c83f5513933dfc5daeb82ea4c9724c21ce915c0e1cf80adae826328dc0a20b9978d
SSDEEP 6144:nesmzyHFkzaR+lDAAJq+SbXdE7ItTZA3s0bxM7:nGyHm1dAAJybXdE7IlZ8s0q7
TLSH
T128A4F6E06741C0A1CBC355B5E8778EAF6033610D9D2A598E3A86BF3F3E76351461AC4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-28_a9f123221849f1c0d862c59aad6fb5ae_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop

File Explorer

2026-07-28_a9f123221849f1c0d862c59aad6fb5ae_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop

.exe 449KB

2026-07-28_a9f123221849f1c0d862c59aad6fb5ae_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop

IMPHASH a6c06faeef749066e12148fb3fd3ff58
SHA256 5a66a4016547a695d719941d11414d65dbda4835e8bb0ca4137543576bfef303
MD5 a9f123221849f1c0d862c59aad6fb5ae
SHA1 954cf311e1e9c5fb26f2b61c05ac1c854f8a7a45
SHA512 533089c3100c772285c897d3d5f1b74e827b70e1932088879369e4c9c41b0c83f5513933dfc5daeb82ea4c9724c21ce915c0e1cf80adae826328dc0a20b9978d
SSDEEP 6144:nesmzyHFkzaR+lDAAJq+SbXdE7ItTZA3s0bxM7:nGyHm1dAAJybXdE7IlZ8s0q7
TLSH
T128A4F6E06741C0A1CBC355B5E8778EAF6033610D9D2A598E3A86BF3F3E76351461AC4B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

32401

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ExitProcess GetModuleHandleA Module32Next GetTempPathA GetEnvironmentVariableA lstrlenA GetShortPathNameA ResumeThread FindResourceA VirtualAllocEx GetModuleFileNameA LoadResource CreateProcessA Sleep LoadLibraryA GetProcAddress lstrcatA ReadProcessMemory GetThreadContext Process32Next Process32First Module32First CreateToolhelp32Snapshot lstrcpyA SetEndOfFile CreateFileW InterlockedIncrement InterlockedDecrement InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapAlloc TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetLastError HeapFree GetCommandLineA GetVersionExA GetProcessHeap GetStartupInfoA RaiseException RtlUnwind LCMapStringA WideCharToMultiByte MultiByteToWideChar LCMapStringW GetCPInfo WriteFile GetConsoleCP GetConsoleMode VirtualFree VirtualAlloc HeapReAlloc HeapDestroy HeapCreate GetStdHandle ReadFile SetHandleCount GetFileType SetFilePointer TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId CloseHandle FlushFileBuffers FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW HeapSize WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA GetLocaleInfoW

user32

MessageBoxA

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey RegCreateKeyExA

shell32

ShellExecuteA

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-28_a9f123221849f1c0d862c59aad6fb5ae_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop

kernel32

user32

advapi32

shell32

generic