General
- Target 2026-11-10_2c451c781fb7370aceefe5f8e1cd01cd_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop
- Size 449KB
- Sample261110-kwmslsec29
- SHA256 547b39b1b0ae3ef36fd9e244fc26e962333bf6c7d5bc320815bd6f17a37a17f9
- MD5 2c451c781fb7370aceefe5f8e1cd01cd
- SHA1 fa2167550786f3179be8ac3a777fb6826e880fba
- SHA512 11882e9e8b63844f6b537ce4c4da9cc037cb0cc0dbefe9092b7800d07a7df3a2c38ee0f5b3ecbb0a91b4745ffb295e2a0d8d50eb14a81b341f4b37f67de0e347
- SSDEEP 6144:nesmzyHFkzaR+lDAAJq+SbXdE7ItTZA3s0bxMacccccccccccccccccccccccccc:nGyHm1dAAJybXdE7IlZ8s0qe
- TLSH T14DA42AF43B408830E787597EC43B5EAF6532A40D8D66264E3885BF2E7DB5305467A8CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-10_2c451c781fb7370aceefe5f8e1cd01cd_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
Resource
win10v2004-20260911-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-10_2c451c781fb7370aceefe5f8e1cd01cd_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-11-10_2c451c781fb7370aceefe5f8e1cd01cd_elex_hiddentear_manuscrypt_remcos_rhadamanthys_stop
- Size 449KB
- SHA256 547b39b1b0ae3ef36fd9e244fc26e962333bf6c7d5bc320815bd6f17a37a17f9
- MD5 2c451c781fb7370aceefe5f8e1cd01cd
- SHA1 fa2167550786f3179be8ac3a777fb6826e880fba
- SHA512 11882e9e8b63844f6b537ce4c4da9cc037cb0cc0dbefe9092b7800d07a7df3a2c38ee0f5b3ecbb0a91b4745ffb295e2a0d8d50eb14a81b341f4b37f67de0e347
- SSDEEP 6144:nesmzyHFkzaR+lDAAJq+SbXdE7ItTZA3s0bxMacccccccccccccccccccccccccc:nGyHm1dAAJybXdE7IlZ8s0qe
- TLSH T14DA42AF43B408830E787597EC43B5EAF6532A40D8D66264E3885BF2E7DB5305467A8CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10Modifies visibility of hidden/system files in Explorer
Executes dropped EXE
Adds Run key to start application
Drops file in System32 directory
Suspicious use of SetThreadContext