General
- Target 2026-10-19_373ac79b173546727a457e7ed8b18f0a_elex_emotet_icedid_krbanker_remcos_stop
- Size 1.5MB
- Sample261020-3fg7asxtgx
- SHA256 4ba5b12358bd799e46edbe687f1cc1f733a96f227d097942a5a29e8b6018814e
- MD5 373ac79b173546727a457e7ed8b18f0a
- SHA1 884e7b0e0621ca6224bb40148e2ce599a7f6d284
- SHA512 f072914989550486f0d3e335c5801e0763fcfeb5bd10cbb189ec652dbca245a66b6bb6c8e7238684b1af80bd3ca6bc5c2d8ed44b610608762561f511e0e57bc0
- SSDEEP 24576:0++ZwJfwCI8Ddfs/kMUftLGZ98FlE6wI+gfnlRIfaE3JRdZ:01/kjtPlERDGnlRANRdZ
- TLSH T186757C23E691C0F1D11100B11AF5573DAA78BB774E359BA3EB92DEB45D212E2CE1720E
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-19_373ac79b173546727a457e7ed8b18f0a_elex_emotet_icedid_krbanker_remcos_stop.exe
Resource
win10v2004-20260911-en
22 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-19_373ac79b173546727a457e7ed8b18f0a_elex_emotet_icedid_krbanker_remcos_stop
- Size 1.5MB
- SHA256 4ba5b12358bd799e46edbe687f1cc1f733a96f227d097942a5a29e8b6018814e
- MD5 373ac79b173546727a457e7ed8b18f0a
- SHA1 884e7b0e0621ca6224bb40148e2ce599a7f6d284
- SHA512 f072914989550486f0d3e335c5801e0763fcfeb5bd10cbb189ec652dbca245a66b6bb6c8e7238684b1af80bd3ca6bc5c2d8ed44b610608762561f511e0e57bc0
- SSDEEP 24576:0++ZwJfwCI8Ddfs/kMUftLGZ98FlE6wI+gfnlRIfaE3JRdZ:01/kjtPlERDGnlRANRdZ
- TLSH T186757C23E691C0F1D11100B11AF5573DAA78BB774E359BA3EB92DEB45D212E2CE1720E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
MITRE ATT&CK Enterprise v16
Defense Evasion
Direct Volume Access
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1