General
- Target 2026-11-10_71e3a6f9a6618faf8dee4660195f7ca3_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop
- Size 449KB
- Sample261110-h2ecbaz1bx
- SHA256 568d6fd26362c69adef95a6b610c53f5a9bc1f8db5d1556721f4157a8442c075
- MD5 71e3a6f9a6618faf8dee4660195f7ca3
- SHA1 6d36f8e7a6c67045673ffa0d116c54e7aad60bc1
- SHA512 9a6b98dae40ceee36382e9e18b9ef511fddbcdb67114881fc0c294151bc7714f3e6dee7c444508d8080165a529160d024b0960111486d2c73dacc7389b934039
- SSDEEP 6144:nesmzyHFkzaR+lDAAJq+SbXdE7ItTZA3s0bxMF:nGyHm1dAAJybXdE7IlZ8s0qF
- TLSH T19DA408E06F4080A4EB974A79C4374DAF6533680CED29194F3685FF1E7E3539285278AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-10_71e3a6f9a6618faf8dee4660195f7ca3_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
Resource
win10v2004-20260911-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-10_71e3a6f9a6618faf8dee4660195f7ca3_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-11-10_71e3a6f9a6618faf8dee4660195f7ca3_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop
- Size 449KB
- SHA256 568d6fd26362c69adef95a6b610c53f5a9bc1f8db5d1556721f4157a8442c075
- MD5 71e3a6f9a6618faf8dee4660195f7ca3
- SHA1 6d36f8e7a6c67045673ffa0d116c54e7aad60bc1
- SHA512 9a6b98dae40ceee36382e9e18b9ef511fddbcdb67114881fc0c294151bc7714f3e6dee7c444508d8080165a529160d024b0960111486d2c73dacc7389b934039
- SSDEEP 6144:nesmzyHFkzaR+lDAAJq+SbXdE7ItTZA3s0bxMF:nGyHm1dAAJybXdE7IlZ8s0qF
- TLSH T19DA408E06F4080A4EB974A79C4374DAF6533680CED29194F3685FF1E7E3539285278AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10Modifies visibility of hidden/system files in Explorer
Executes dropped EXE
Adds Run key to start application
Drops file in System32 directory
Suspicious use of SetThreadContext