General
- Target 2026-11-01_f5e5750ee3d7d23e413baa386fe8ffc4_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop
- Size 449KB
- Sample261102-ddbt3aev7y
- SHA256 25ba7f4ab1533f17d1336329f4f0cac732e6838bbf2936280affac66436448af
- MD5 f5e5750ee3d7d23e413baa386fe8ffc4
- SHA1 25709765655de5247c5d8cfbbdc7afc434c67add
- SHA512 811f918d730b49ce81077764730e2d563f05e1b4b5cf43e0e6281f39551c7ac52bc960edec338c081f707ce3cd91a55e02179c6e24d11bc55cd812cadfa0056e
- SSDEEP 6144:nesmzyHFkzaR+lDAAJq+SbXdE7ItTZA3s0bxMi:nGyHm1dAAJybXdE7IlZ8s0qi
- TLSH T102A419E037508070C7974079D43B5E6F6433AA4EAD7A258F39D9BF6A7D32381016B4AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-01_f5e5750ee3d7d23e413baa386fe8ffc4_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
Resource
win10v2004-20260911-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-01_f5e5750ee3d7d23e413baa386fe8ffc4_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-11-01_f5e5750ee3d7d23e413baa386fe8ffc4_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop
- Size 449KB
- SHA256 25ba7f4ab1533f17d1336329f4f0cac732e6838bbf2936280affac66436448af
- MD5 f5e5750ee3d7d23e413baa386fe8ffc4
- SHA1 25709765655de5247c5d8cfbbdc7afc434c67add
- SHA512 811f918d730b49ce81077764730e2d563f05e1b4b5cf43e0e6281f39551c7ac52bc960edec338c081f707ce3cd91a55e02179c6e24d11bc55cd812cadfa0056e
- SSDEEP 6144:nesmzyHFkzaR+lDAAJq+SbXdE7ItTZA3s0bxMi:nGyHm1dAAJybXdE7IlZ8s0qi
- TLSH T102A419E037508070C7974079D43B5E6F6433AA4EAD7A258F39D9BF6A7D32381016B4AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies visibility of hidden/system files in Explorer
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext