General
- Target 2026-10-19_461dbe65471c30a87a47a633049bda80_elex_emotet_icedid_krbanker_remcos_stop
- Size 1.5MB
- Sample261020-1psnaaav2n
- SHA256 28355fe3f72aa88cb3c1f80e9c79af53a0956f6afa4bc8aa12c52f997958d525
- MD5 461dbe65471c30a87a47a633049bda80
- SHA1 6c646d0cbc4846ef2d0abf87e72aad87865b4b42
- SHA512 d5d5f1b4bb959c571ed4129a16fddcf88fe134315d5b485772717216462a3cdf27bd8c9554e2dc43f73bbee4616ea2539d8972999603715d279dd9f8f0d33030
- SSDEEP 24576:0++ZwJfwCI8Ddfs/kMUftLGZ98FlE6wI+gfnlRIfaE3JRdv:01/kjtPlERDGnlRANRdv
- TLSH T138757C23E691C0F1D11100B11AF5573DAA78BB774E359BA3EB92DEB45D212E2CE1720E
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-19_461dbe65471c30a87a47a633049bda80_elex_emotet_icedid_krbanker_remcos_stop.exe
Resource
win10v2004-20260911-en
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-19_461dbe65471c30a87a47a633049bda80_elex_emotet_icedid_krbanker_remcos_stop.exe
Resource
win11ltsc2024-20260911-en
20 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-19_461dbe65471c30a87a47a633049bda80_elex_emotet_icedid_krbanker_remcos_stop
- Size 1.5MB
- SHA256 28355fe3f72aa88cb3c1f80e9c79af53a0956f6afa4bc8aa12c52f997958d525
- MD5 461dbe65471c30a87a47a633049bda80
- SHA1 6c646d0cbc4846ef2d0abf87e72aad87865b4b42
- SHA512 d5d5f1b4bb959c571ed4129a16fddcf88fe134315d5b485772717216462a3cdf27bd8c9554e2dc43f73bbee4616ea2539d8972999603715d279dd9f8f0d33030
- SSDEEP 24576:0++ZwJfwCI8Ddfs/kMUftLGZ98FlE6wI+gfnlRIfaE3JRdv:01/kjtPlERDGnlRANRdv
- TLSH T138757C23E691C0F1D11100B11AF5573DAA78BB774E359BA3EB92DEB45D212E2CE1720E
- MD5 SHA1 SHA512 SSDEEP TLSH
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
MITRE ATT&CK Enterprise v16
Defense Evasion
Direct Volume Access
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1