General
- Target 2026-08-22_32fe509e21cbfd7a8e29cfe03573437e_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop
- Size 449KB
- Sample260823-ma536saa29
- SHA256 f566dea0fc42b2af53cc1d2b0ae086513b38cb1fefa1f714468bd39708f4a7f4
- MD5 32fe509e21cbfd7a8e29cfe03573437e
- SHA1 58a0c3e7c3a3744b8fe39d7959b70fdb180b75e8
- SHA512 aad88a4352b5aec44509890e4c23be4ab89eb7ecb6dad84f868a986e18b302d403340cc4fb4cfb5657a33bb57f8f32314a37710ba3fc526f1139bac30eda438a
- SSDEEP 6144:nesmzyHFkzaR+lDAAJq+SbXdE7ItTZA3s0bxMg:nGyHm1dAAJybXdE7IlZ8s0qg
- TLSH T175A4F7E527548066D7D78978C4338DEF6173954D9C3A194E38A9FF2A3D72342823B88B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-22_32fe509e21cbfd7a8e29cfe03573437e_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-22_32fe509e21cbfd7a8e29cfe03573437e_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-22_32fe509e21cbfd7a8e29cfe03573437e_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop
- Size 449KB
- SHA256 f566dea0fc42b2af53cc1d2b0ae086513b38cb1fefa1f714468bd39708f4a7f4
- MD5 32fe509e21cbfd7a8e29cfe03573437e
- SHA1 58a0c3e7c3a3744b8fe39d7959b70fdb180b75e8
- SHA512 aad88a4352b5aec44509890e4c23be4ab89eb7ecb6dad84f868a986e18b302d403340cc4fb4cfb5657a33bb57f8f32314a37710ba3fc526f1139bac30eda438a
- SSDEEP 6144:nesmzyHFkzaR+lDAAJq+SbXdE7ItTZA3s0bxMg:nGyHm1dAAJybXdE7IlZ8s0qg
- TLSH T175A4F7E527548066D7D78978C4338DEF6173954D9C3A194E38A9FF2A3D72342823B88B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies visibility of hidden/system files in Explorer
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext