General
- Target 2026-11-10_adb037aee69b6be51f25fbd57abdd3cc_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop
- Size 449KB
- Sample261110-gkh4hadb97
- SHA256 07c0d0af932acc5587a38ebb4e5a7404a43432e348fd6291d2972a9913cd6dd5
- MD5 adb037aee69b6be51f25fbd57abdd3cc
- SHA1 f6f85016cf467032f3298fc6c6362c08e62b6e33
- SHA512 130a3f6054d5c03b2a30f94e5c326d7d37f3d514838b43be14b703bb0e078c85853cb99049ffdb66547c98859281ffbba20a4272a89114c4c4ee4bd6f727a763
- SSDEEP 6144:nesmzyHFkzaR+lDAAJq+SbXdE7ItTZA3s0bxMF:nGyHm1dAAJybXdE7IlZ8s0qF
- TLSH T12BA419E12740D066DB879479C4375E9F6433A40CADAA134E3A8AFF5E3C76341416ECAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-10_adb037aee69b6be51f25fbd57abdd3cc_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
Resource
win10v2004-20260911-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-10_adb037aee69b6be51f25fbd57abdd3cc_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-11-10_adb037aee69b6be51f25fbd57abdd3cc_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop
- Size 449KB
- SHA256 07c0d0af932acc5587a38ebb4e5a7404a43432e348fd6291d2972a9913cd6dd5
- MD5 adb037aee69b6be51f25fbd57abdd3cc
- SHA1 f6f85016cf467032f3298fc6c6362c08e62b6e33
- SHA512 130a3f6054d5c03b2a30f94e5c326d7d37f3d514838b43be14b703bb0e078c85853cb99049ffdb66547c98859281ffbba20a4272a89114c4c4ee4bd6f727a763
- SSDEEP 6144:nesmzyHFkzaR+lDAAJq+SbXdE7ItTZA3s0bxMF:nGyHm1dAAJybXdE7IlZ8s0qF
- TLSH T12BA419E12740D066DB879479C4375E9F6433A40CADAA134E3A8AFF5E3C76341416ECAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10Modifies visibility of hidden/system files in Explorer
Executes dropped EXE
Adds Run key to start application
Drops file in System32 directory
Suspicious use of SetThreadContext