General
- Target 2026-08-25_d6a7a4083c5a7ca8f737c75658b73ec3_elex_mafia_nionspy_remcos
- Size 288KB
- Sample260826-h2fv5shr8t
- SHA256 a1bcfc2ddb981618c2a83993b8df81bbc244295ae074c4abfafaf8a6e851dc77
- MD5 d6a7a4083c5a7ca8f737c75658b73ec3
- SHA1 57289b34ae656bff750b6c960b1fbea06baec05b
- SHA512 d5dd84b5f24b4b34577e917671d292e4246d6267b867eac95b355a275c125e2035686693248a424ba9a8e4368369d9c4bbf0255e84e586b84a0a7b7cf17071a2
- SSDEEP 6144:vQ+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:vQMyfmNFHfnWfhLZVHmOog
- TLSH T1C8549C107691C432C457267045AFABB24D793A752F36A6C3B7E01E69DE203E2EE7434E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-25_d6a7a4083c5a7ca8f737c75658b73ec3_elex_mafia_nionspy_remcos.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-25_d6a7a4083c5a7ca8f737c75658b73ec3_elex_mafia_nionspy_remcos.exe
Resource
win11ltsc2024-20260710-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-25_d6a7a4083c5a7ca8f737c75658b73ec3_elex_mafia_nionspy_remcos
- Size 288KB
- SHA256 a1bcfc2ddb981618c2a83993b8df81bbc244295ae074c4abfafaf8a6e851dc77
- MD5 d6a7a4083c5a7ca8f737c75658b73ec3
- SHA1 57289b34ae656bff750b6c960b1fbea06baec05b
- SHA512 d5dd84b5f24b4b34577e917671d292e4246d6267b867eac95b355a275c125e2035686693248a424ba9a8e4368369d9c4bbf0255e84e586b84a0a7b7cf17071a2
- SSDEEP 6144:vQ+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:vQMyfmNFHfnWfhLZVHmOog
- TLSH T1C8549C107691C432C457267045AFABB24D793A752F36A6C3B7E01E69DE203E2EE7434E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE