General
- Target 2026-08-24_7c66f199257d0b4e75b68c6f55fb6471_elex_kwampirs_mafia_manuscrypt_rhadamanthys_stop
- Size 1015KB
- Sample260825-lnempsgf34
- SHA256 91ef2fcbf1120c7961565de6aa5ea2e504acdd0bff826f015e47ebdf56e6b517
- MD5 7c66f199257d0b4e75b68c6f55fb6471
- SHA1 e2df109f2469c73d8c10ce2b0567313f7ecc7fb5
- SHA512 5c0d74f72e2a71b42d712a61d7927c4eb8ae7aa13a149796c0c08c67847c2d07cde41b7396d8e37382ac712a7538877e05ed8b19e8729c969ee803774e60da9e
- SSDEEP 1536:wJd4Z3OD+PjcatQCq1LAK1hdCB8RQzXzgH4PODVj3O/eyUJUbe1ccfyY6+BrnJJR:wJC9e+LcatRmdxQ/rw3wUE8ccf7FnJp1
- TLSH T11B258C2236C1C072E26315348EA5D3B18A3AFC714E719DDB7BD503BA5F696C2DA28317
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-08-24_7c66f199257d0b4e75b68c6f55fb6471_elex_kwampirs_mafia_manuscrypt_rhadamanthys_stop.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-08-24_7c66f199257d0b4e75b68c6f55fb6471_elex_kwampirs_mafia_manuscrypt_rhadamanthys_stop.exe
Resource
win11ltsc2024-20260709-en
Malware Config
Targets
-
- Target 2026-08-24_7c66f199257d0b4e75b68c6f55fb6471_elex_kwampirs_mafia_manuscrypt_rhadamanthys_stop
- Size 1015KB
- SHA256 91ef2fcbf1120c7961565de6aa5ea2e504acdd0bff826f015e47ebdf56e6b517
- MD5 7c66f199257d0b4e75b68c6f55fb6471
- SHA1 e2df109f2469c73d8c10ce2b0567313f7ecc7fb5
- SHA512 5c0d74f72e2a71b42d712a61d7927c4eb8ae7aa13a149796c0c08c67847c2d07cde41b7396d8e37382ac712a7538877e05ed8b19e8729c969ee803774e60da9e
- SSDEEP 1536:wJd4Z3OD+PjcatQCq1LAK1hdCB8RQzXzgH4PODVj3O/eyUJUbe1ccfyY6+BrnJJR:wJC9e+LcatRmdxQ/rw3wUE8ccf7FnJp1
- TLSH T11B258C2236C1C072E26315348EA5D3B18A3AFC714E719DDB7BD503BA5F696C2DA28317
- MD5 SHA1 SHA512 SSDEEP TLSH
-
UAC bypass
-
Modifies Windows Firewall
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks whether UAC is enabled
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Modify Registry
3