General
- Target 2026-08-01_4006f34f11bcddc8568a8e2f7cd3bb19_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop
- Size 449KB
- Sample260801-d1e51ach99
- SHA256 66d502ac86a8da3d05ecefe5994b1e5ea324b0e02cb5dc08cb11bea96210867b
- MD5 4006f34f11bcddc8568a8e2f7cd3bb19
- SHA1 2257226f81be38837bd5273bc2ba0bb767b2db20
- SHA512 6e21af7c9167ce73b1dbd4d8d9a32ab90483cfb218af3a2d383357f04cf048338f1343853256c73b9ab393b6761b2d86bea4919c8811dabf234e99fdcd47822e
- SSDEEP 6144:nesmzyHFkzaR+lDAAJq+SbXdE7ItTZA3s0bxMk:nGyHm1dAAJybXdE7IlZ8s0qk
- TLSH T131A42AE537048061DF935ABDC03B9DEF6833A15C5C6A968E3549BF2E7D32351403A8AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_4006f34f11bcddc8568a8e2f7cd3bb19_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_4006f34f11bcddc8568a8e2f7cd3bb19_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-01_4006f34f11bcddc8568a8e2f7cd3bb19_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop
- Size 449KB
- SHA256 66d502ac86a8da3d05ecefe5994b1e5ea324b0e02cb5dc08cb11bea96210867b
- MD5 4006f34f11bcddc8568a8e2f7cd3bb19
- SHA1 2257226f81be38837bd5273bc2ba0bb767b2db20
- SHA512 6e21af7c9167ce73b1dbd4d8d9a32ab90483cfb218af3a2d383357f04cf048338f1343853256c73b9ab393b6761b2d86bea4919c8811dabf234e99fdcd47822e
- SSDEEP 6144:nesmzyHFkzaR+lDAAJq+SbXdE7ItTZA3s0bxMk:nGyHm1dAAJybXdE7IlZ8s0qk
- TLSH T131A42AE537048061DF935ABDC03B9DEF6833A15C5C6A968E3549BF2E7D32351403A8AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies visibility of hidden/system files in Explorer
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext