General
- Target 2026-08-23_97c0ceb56f14dbe876fc79fad6d5e5e0_elex_emotet_icedid_krbanker_remcos_stop
- Size 1.5MB
- Sample260824-e4cdysshla
- SHA256 ca11c384e0e49c95995cc82c2467c68c74bb70e5b9377be29850f9a1831482c4
- MD5 97c0ceb56f14dbe876fc79fad6d5e5e0
- SHA1 0f4d2c80c1dd4d4508eef04fa8baaceace38f6d8
- SHA512 b1f6eb81579448ddc5f71e4b404a3105016d3c73636ec769d0f08d4f1824472971828e08f5bc0d9251ebe6f86fa2d50820a0c1c2d2e8b8a5978b06a24bbed79f
- SSDEEP 24576:0++ZwJfwCI8Ddfs/kMUftLGZ98FlE6wI+gfnlRIfaE3JRd4:01/kjtPlERDGnlRANRd4
- TLSH T1F2757C23E691C0F1D11100B11AF5573DAA78BB774E359BA3EB92DEB45D212E2CE1720E
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-23_97c0ceb56f14dbe876fc79fad6d5e5e0_elex_emotet_icedid_krbanker_remcos_stop.exe
Resource
win10v2004-20260513-en
20 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-23_97c0ceb56f14dbe876fc79fad6d5e5e0_elex_emotet_icedid_krbanker_remcos_stop
- Size 1.5MB
- SHA256 ca11c384e0e49c95995cc82c2467c68c74bb70e5b9377be29850f9a1831482c4
- MD5 97c0ceb56f14dbe876fc79fad6d5e5e0
- SHA1 0f4d2c80c1dd4d4508eef04fa8baaceace38f6d8
- SHA512 b1f6eb81579448ddc5f71e4b404a3105016d3c73636ec769d0f08d4f1824472971828e08f5bc0d9251ebe6f86fa2d50820a0c1c2d2e8b8a5978b06a24bbed79f
- SSDEEP 24576:0++ZwJfwCI8Ddfs/kMUftLGZ98FlE6wI+gfnlRIfaE3JRd4:01/kjtPlERDGnlRANRd4
- TLSH T1F2757C23E691C0F1D11100B11AF5573DAA78BB774E359BA3EB92DEB45D212E2CE1720E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.