General
- Target 2026-08-22_41131235f48bbb38b3f0e8783a906342_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop
- Size 449KB
- Sample260823-ld6cnsfp2y
- SHA256 f21b8752c6168a325aa54824c86db267851c04b2dc411f56f7179a6d046f2808
- MD5 41131235f48bbb38b3f0e8783a906342
- SHA1 39b2ecccdbfc7deec088816ccb290129bc0c0180
- SHA512 3b2c3ea284cdf82f41ff40faef3db4ea067c8abafcef76ef8aaaefb53d1dc7669051d2526890f8e3083f96f45de0a6bf98c0136022210441639e7c9671de6303
- SSDEEP 6144:nesmzyHFkzaR+lDAAJq+SbXdE7ItTZA3s0bxMt:nGyHm1dAAJybXdE7IlZ8s0qt
- TLSH T129A408E43350C0A5DB878479D4779EEF9032A41D8C69298F3992FF5E7E3234241678AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-22_41131235f48bbb38b3f0e8783a906342_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-22_41131235f48bbb38b3f0e8783a906342_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-22_41131235f48bbb38b3f0e8783a906342_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop
- Size 449KB
- SHA256 f21b8752c6168a325aa54824c86db267851c04b2dc411f56f7179a6d046f2808
- MD5 41131235f48bbb38b3f0e8783a906342
- SHA1 39b2ecccdbfc7deec088816ccb290129bc0c0180
- SHA512 3b2c3ea284cdf82f41ff40faef3db4ea067c8abafcef76ef8aaaefb53d1dc7669051d2526890f8e3083f96f45de0a6bf98c0136022210441639e7c9671de6303
- SSDEEP 6144:nesmzyHFkzaR+lDAAJq+SbXdE7ItTZA3s0bxMt:nGyHm1dAAJybXdE7IlZ8s0qt
- TLSH T129A408E43350C0A5DB878479D4779EEF9032A41D8C69298F3992FF5E7E3234241678AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies visibility of hidden/system files in Explorer
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext