General
- Target 2026-08-21_9e823fba2a2124ef6298f67f3c8f3151_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop
- Size 449KB
- Sample260822-lbkm7ashme
- SHA256 d37aa5790ff8698caad9762b7354ed73a54c80c9b285c28e4315edbfd8a099f3
- MD5 9e823fba2a2124ef6298f67f3c8f3151
- SHA1 7fe17a1b532e0628384d5d23e5a4708e863c7ba9
- SHA512 a173c3fa3a50ba15f41243d6d85395372752fd3be9d4be72b75537b55b8c4a13903e54cea6b8744304534e6ce1cb5380c2dfa74119ad6b86bafdd2754a5a7fe2
- SSDEEP 6144:nesmzyHFkzaR+lDAAJq+SbXdE7ItTZA3s0bxMo:nGyHm1dAAJybXdE7IlZ8s0qo
- TLSH T132A41AF077518091DB878678C4379F6B5833A44DBDA9964E3982FF5B3C32391812A8DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-21_9e823fba2a2124ef6298f67f3c8f3151_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-21_9e823fba2a2124ef6298f67f3c8f3151_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-21_9e823fba2a2124ef6298f67f3c8f3151_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop
- Size 449KB
- SHA256 d37aa5790ff8698caad9762b7354ed73a54c80c9b285c28e4315edbfd8a099f3
- MD5 9e823fba2a2124ef6298f67f3c8f3151
- SHA1 7fe17a1b532e0628384d5d23e5a4708e863c7ba9
- SHA512 a173c3fa3a50ba15f41243d6d85395372752fd3be9d4be72b75537b55b8c4a13903e54cea6b8744304534e6ce1cb5380c2dfa74119ad6b86bafdd2754a5a7fe2
- SSDEEP 6144:nesmzyHFkzaR+lDAAJq+SbXdE7ItTZA3s0bxMo:nGyHm1dAAJybXdE7IlZ8s0qo
- TLSH T132A41AF077518091DB878678C4379F6B5833A44DBDA9964E3982FF5B3C32391812A8DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies visibility of hidden/system files in Explorer
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext