General
- Target 2026-10-19_394fa27d587246347de5e28b71f616b0_elex_emotet_icedid_krbanker_remcos_stop
- Size 1.5MB
- Sample261020-275agags2x
- SHA256 17e61cb810e5e783020d1c5d2e6d2b5cb52c74a9e1d3466d238951382557f7ff
- MD5 394fa27d587246347de5e28b71f616b0
- SHA1 016d3ad67433e7fe4dc0d308a171b8e410decb75
- SHA512 cf46c320415242d761b6d0fec7c6bd66808e4e6323c81a64bd4d01a5f030460df2493f5c2712479f14987bf2d12e6440aff628cb2bcaf88ac15a8fe79d7499a9
- SSDEEP 24576:0++ZwJfwCI8Ddfs/kMUftLGZ98FlE6wI+gfnlRIfaE3JRdO:01/kjtPlERDGnlRANRdO
- TLSH T122757C23E691C0F1D11100B11AF5573DAA78BB774E359BA3EB92DEB45D212E2CE1720E
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-19_394fa27d587246347de5e28b71f616b0_elex_emotet_icedid_krbanker_remcos_stop.exe
Resource
win10v2004-20260911-en
21 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-19_394fa27d587246347de5e28b71f616b0_elex_emotet_icedid_krbanker_remcos_stop.exe
Resource
win11ltsc2024-20260911-en
20 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-19_394fa27d587246347de5e28b71f616b0_elex_emotet_icedid_krbanker_remcos_stop
- Size 1.5MB
- SHA256 17e61cb810e5e783020d1c5d2e6d2b5cb52c74a9e1d3466d238951382557f7ff
- MD5 394fa27d587246347de5e28b71f616b0
- SHA1 016d3ad67433e7fe4dc0d308a171b8e410decb75
- SHA512 cf46c320415242d761b6d0fec7c6bd66808e4e6323c81a64bd4d01a5f030460df2493f5c2712479f14987bf2d12e6440aff628cb2bcaf88ac15a8fe79d7499a9
- SSDEEP 24576:0++ZwJfwCI8Ddfs/kMUftLGZ98FlE6wI+gfnlRIfaE3JRdO:01/kjtPlERDGnlRANRdO
- TLSH T122757C23E691C0F1D11100B11AF5573DAA78BB774E359BA3EB92DEB45D212E2CE1720E
- MD5 SHA1 SHA512 SSDEEP TLSH
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.