General
- Target 2026-10-28_9af9c476ca601813c06517a57c08233f_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop
- Size 449KB
- Sample261029-2rg51agy2l
- SHA256 d6a606c5c3e4e0ea7ffaca69612f62b02d45fac6e9a1c485c1ca83a6facd9347
- MD5 9af9c476ca601813c06517a57c08233f
- SHA1 264c11add5c26ada59bfc6f266a18743a3b5183f
- SHA512 a526f134201b96b3f518e9e5517e54f11608f481321283219fd8814ddf56cb3f2c5fcfb8d31f65eb55c24821663905111abd27f0984af7cdaa8a4616c34caa23
- SSDEEP 6144:nesmzyHFkzaR+lDAAJq+SbXdE7ItTZA3s0bxM0:nGyHm1dAAJybXdE7IlZ8s0q0
- TLSH T14FA43CF4274180A0CB43967DC8379DEB6532A52CCDAA594E3A89FF0E7D71342812B5DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-28_9af9c476ca601813c06517a57c08233f_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
Resource
win10v2004-20260911-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-28_9af9c476ca601813c06517a57c08233f_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-28_9af9c476ca601813c06517a57c08233f_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop
- Size 449KB
- SHA256 d6a606c5c3e4e0ea7ffaca69612f62b02d45fac6e9a1c485c1ca83a6facd9347
- MD5 9af9c476ca601813c06517a57c08233f
- SHA1 264c11add5c26ada59bfc6f266a18743a3b5183f
- SHA512 a526f134201b96b3f518e9e5517e54f11608f481321283219fd8814ddf56cb3f2c5fcfb8d31f65eb55c24821663905111abd27f0984af7cdaa8a4616c34caa23
- SSDEEP 6144:nesmzyHFkzaR+lDAAJq+SbXdE7ItTZA3s0bxM0:nGyHm1dAAJybXdE7IlZ8s0q0
- TLSH T14FA43CF4274180A0CB43967DC8379DEB6532A52CCDAA594E3A89FF0E7D71342812B5DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies visibility of hidden/system files in Explorer
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext