General
- Target 2026-08-20_2a2faa3d56a4a8422817cbb03072a364_elex_emotet_icedid_krbanker_remcos_stop
- Size 1.5MB
- Sample260821-a2k6vsgg76
- SHA256 394cbda2d3c8071d5549b532731730f2c17a546a3898dc175e83fa7d7999dc91
- MD5 2a2faa3d56a4a8422817cbb03072a364
- SHA1 c248a18c58016923411bd4c04abf0cb71a203865
- SHA512 c05774677691dd72c9ebeccdfb50b2cf6534f99d4ac901667fb5c327878221b228b2ca25de8265ce59228e4cba6b533c5b4634031d7282bee9d80d01e1eb5d99
- SSDEEP 24576:0++ZwJfwCI8Ddfs/kMUftLGZ98FlE6wI+gfnlRIfaE3JRdC:01/kjtPlERDGnlRANRdC
- TLSH T19C757C23E691C0F1D11100B11AF5573DAA78BB774E359BA3EB92DEB45D212E2CE1720E
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_2a2faa3d56a4a8422817cbb03072a364_elex_emotet_icedid_krbanker_remcos_stop.exe
Resource
win10v2004-20260513-en
19 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-20_2a2faa3d56a4a8422817cbb03072a364_elex_emotet_icedid_krbanker_remcos_stop
- Size 1.5MB
- SHA256 394cbda2d3c8071d5549b532731730f2c17a546a3898dc175e83fa7d7999dc91
- MD5 2a2faa3d56a4a8422817cbb03072a364
- SHA1 c248a18c58016923411bd4c04abf0cb71a203865
- SHA512 c05774677691dd72c9ebeccdfb50b2cf6534f99d4ac901667fb5c327878221b228b2ca25de8265ce59228e4cba6b533c5b4634031d7282bee9d80d01e1eb5d99
- SSDEEP 24576:0++ZwJfwCI8Ddfs/kMUftLGZ98FlE6wI+gfnlRIfaE3JRdC:01/kjtPlERDGnlRANRdC
- TLSH T19C757C23E691C0F1D11100B11AF5573DAA78BB774E359BA3EB92DEB45D212E2CE1720E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.