General
- Target 2026-08-23_921a6b8862a386a9a098060d2392089d_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop
- Size 449KB
- Sample260825-3dqewsbb66
- SHA256 25a9763935630384945e7ff01d007a9fc9381f5a1b55de3faeed11051eb670d8
- MD5 921a6b8862a386a9a098060d2392089d
- SHA1 55660762fc28c87b263b9c35b55f69ff38630c6c
- SHA512 d87b538276e17d763464791145e9cc2dca257aef1967f6aba87007585b35ea918a1036cb75bf4b5e1d20c9200b9ecf97ed7955346e37348301ef4f578f0ceb80
- SSDEEP 6144:nesmzyHFkzaR+lDAAJq+SbXdE7ItTZA3s0bxMk:nGyHm1dAAJybXdE7IlZ8s0qk
- TLSH T107A43BE022148065DBC74A76D03BDEBFA133591EAD78450E7AC5BF1B7E32381112A8DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-23_921a6b8862a386a9a098060d2392089d_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-23_921a6b8862a386a9a098060d2392089d_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-23_921a6b8862a386a9a098060d2392089d_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop
- Size 449KB
- SHA256 25a9763935630384945e7ff01d007a9fc9381f5a1b55de3faeed11051eb670d8
- MD5 921a6b8862a386a9a098060d2392089d
- SHA1 55660762fc28c87b263b9c35b55f69ff38630c6c
- SHA512 d87b538276e17d763464791145e9cc2dca257aef1967f6aba87007585b35ea918a1036cb75bf4b5e1d20c9200b9ecf97ed7955346e37348301ef4f578f0ceb80
- SSDEEP 6144:nesmzyHFkzaR+lDAAJq+SbXdE7ItTZA3s0bxMk:nGyHm1dAAJybXdE7IlZ8s0qk
- TLSH T107A43BE022148065DBC74A76D03BDEBFA133591EAD78450E7AC5BF1B7E32381112A8DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies visibility of hidden/system files in Explorer
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext