General
- Target 2026-08-31_bbd5d928c7503d37980c0f8d6a975af9_elex_mafia_nionspy_remcos
- Size 288KB
- Sample260831-spahpsvbqa
- SHA256 f81d13d2902ad749dd28a6f757eb8bb86a722135b6e77d68884450af283e5a30
- MD5 bbd5d928c7503d37980c0f8d6a975af9
- SHA1 95bdf24ff8acdcd9e90c25e00d4d7a88cfd5c7db
- SHA512 8daee09401a4d90a2f17b8ab7b100336f831eb0d50503f53f4ff310e1fced4b7b0fdcb6eb8acefa546e1a91edfb4e0a28db944128db064411bac41e4f3af629d
- SSDEEP 6144:TQ+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:TQMyfmNFHfnWfhLZVHmOog
- TLSH T16F549C107691C432C457267045AFABB24D793A752F36A6C3B7E01E69DE203E2EE7434E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-31_bbd5d928c7503d37980c0f8d6a975af9_elex_mafia_nionspy_remcos.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-31_bbd5d928c7503d37980c0f8d6a975af9_elex_mafia_nionspy_remcos.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-31_bbd5d928c7503d37980c0f8d6a975af9_elex_mafia_nionspy_remcos
- Size 288KB
- SHA256 f81d13d2902ad749dd28a6f757eb8bb86a722135b6e77d68884450af283e5a30
- MD5 bbd5d928c7503d37980c0f8d6a975af9
- SHA1 95bdf24ff8acdcd9e90c25e00d4d7a88cfd5c7db
- SHA512 8daee09401a4d90a2f17b8ab7b100336f831eb0d50503f53f4ff310e1fced4b7b0fdcb6eb8acefa546e1a91edfb4e0a28db944128db064411bac41e4f3af629d
- SSDEEP 6144:TQ+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:TQMyfmNFHfnWfhLZVHmOog
- TLSH T16F549C107691C432C457267045AFABB24D793A752F36A6C3B7E01E69DE203E2EE7434E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE