General
- Target 2026-10-19_478fe090a3c3f5bb339273e07abe1470_elex_mafia_nionspy_remcos
- Size 327KB
- Sample261020-1hbfesfv2v
- SHA256 2ef88e9d726761de589243ab17242ed5ceb1c56c2464e5cdbd7923523ca19044
- MD5 478fe090a3c3f5bb339273e07abe1470
- SHA1 b883b7381749eb6a33daf7be258a811be9152209
- SHA512 603af4a969766842ef651e06bc03730774b7dbb9a2c1b92d33237201d9db2ee5b24b55800f670ccee573573bcba39b2b4ce27724d025d684fa0a8291187536a0
- SSDEEP 6144:U2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG89gkPzDh1v:U2TFafJiHCWBWPMjVWrXf1v
- TLSH T1CA647D1276C1C032C52A1574D4BBABB349397E355B21A5C3B3D07E69BDB12D2AE3834E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-19_478fe090a3c3f5bb339273e07abe1470_elex_mafia_nionspy_remcos.exe
Resource
win10v2004-20260911-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-19_478fe090a3c3f5bb339273e07abe1470_elex_mafia_nionspy_remcos.exe
Resource
win11ltsc2024-20260911-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-19_478fe090a3c3f5bb339273e07abe1470_elex_mafia_nionspy_remcos
- Size 327KB
- SHA256 2ef88e9d726761de589243ab17242ed5ceb1c56c2464e5cdbd7923523ca19044
- MD5 478fe090a3c3f5bb339273e07abe1470
- SHA1 b883b7381749eb6a33daf7be258a811be9152209
- SHA512 603af4a969766842ef651e06bc03730774b7dbb9a2c1b92d33237201d9db2ee5b24b55800f670ccee573573bcba39b2b4ce27724d025d684fa0a8291187536a0
- SSDEEP 6144:U2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG89gkPzDh1v:U2TFafJiHCWBWPMjVWrXf1v
- TLSH T1CA647D1276C1C032C52A1574D4BBABB349397E355B21A5C3B3D07E69BDB12D2AE3834E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE