General
- Target 2026-08-24_3f66fbfc8fd3017da6f04a05cfd20f96_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop
- Size 449KB
- Sample260825-r7thvshe84
- SHA256 28c3877adb7bed469a4dc9c92e4d6ecdc96e31dda505009bea1e0d8d0fd7a352
- MD5 3f66fbfc8fd3017da6f04a05cfd20f96
- SHA1 c14bf2e2cd6cd13d313fa5d75261b633751d7ce5
- SHA512 d0b38391c202978244680ba6444abefa88c613912c38c111c0594792faea74195d077671c4b6c4b3c1d52b92ca9a4b50d6003c7bc8eb59d9a5db4455ddc71650
- SSDEEP 12288:nGyHm1dAAJybXdE7IlZ8s0q4hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhk:nGPArXdiIL8sF
- TLSH T124A407F167418061DB8784B5C83B8FEF6133A91D9D6A150F3A46BF2F3D32392416689B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-24_3f66fbfc8fd3017da6f04a05cfd20f96_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-24_3f66fbfc8fd3017da6f04a05cfd20f96_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-24_3f66fbfc8fd3017da6f04a05cfd20f96_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop
- Size 449KB
- SHA256 28c3877adb7bed469a4dc9c92e4d6ecdc96e31dda505009bea1e0d8d0fd7a352
- MD5 3f66fbfc8fd3017da6f04a05cfd20f96
- SHA1 c14bf2e2cd6cd13d313fa5d75261b633751d7ce5
- SHA512 d0b38391c202978244680ba6444abefa88c613912c38c111c0594792faea74195d077671c4b6c4b3c1d52b92ca9a4b50d6003c7bc8eb59d9a5db4455ddc71650
- SSDEEP 12288:nGyHm1dAAJybXdE7IlZ8s0q4hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhk:nGPArXdiIL8sF
- TLSH T124A407F167418061DB8784B5C83B8FEF6133A91D9D6A150F3A46BF2F3D32392416689B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies visibility of hidden/system files in Explorer
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext