General
- Target 2026-08-08_b02b12d9ba7b78d846a7152bb18b6d64_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop
- Size 449KB
- Sample260808-g7aqmscb92
- SHA256 8e2e9d601fb8154f7380d98989f925f3685dfd58fd87b794f180f61755b44428
- MD5 b02b12d9ba7b78d846a7152bb18b6d64
- SHA1 e7d234646fce0e4cf30508bcd3480556f2b4d62c
- SHA512 5bda4cf52f5beeeadd6b4006e246933bb512e5f3d0dd1be73589dd7a0ca48da5fd9303c0b0d586343405cc09bde8bcd37502ea56babe0d604f37b90f0ec4406f
- SSDEEP 6144:nesmzyHFkzaR+lDAAJq+SbXdE7ItTZA3s0bxMm:nGyHm1dAAJybXdE7IlZ8s0qm
- TLSH T18DA429E02B40C0F5D7979679C8339EAF9832A54C6D35158E3992BF1F3E36346022A59F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_b02b12d9ba7b78d846a7152bb18b6d64_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_b02b12d9ba7b78d846a7152bb18b6d64_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-08_b02b12d9ba7b78d846a7152bb18b6d64_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop
- Size 449KB
- SHA256 8e2e9d601fb8154f7380d98989f925f3685dfd58fd87b794f180f61755b44428
- MD5 b02b12d9ba7b78d846a7152bb18b6d64
- SHA1 e7d234646fce0e4cf30508bcd3480556f2b4d62c
- SHA512 5bda4cf52f5beeeadd6b4006e246933bb512e5f3d0dd1be73589dd7a0ca48da5fd9303c0b0d586343405cc09bde8bcd37502ea56babe0d604f37b90f0ec4406f
- SSDEEP 6144:nesmzyHFkzaR+lDAAJq+SbXdE7ItTZA3s0bxMm:nGyHm1dAAJybXdE7IlZ8s0qm
- TLSH T18DA429E02B40C0F5D7979679C8339EAF9832A54C6D35158E3992BF1F3E36346022A59F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies visibility of hidden/system files in Explorer
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext