2025-07-04_0704c5c3e8c9f888984c9ef3325e50d3_elex_mafia_rhadamanthys_stealc_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2025-07-04_0704c5c3e8c9f888984c9ef3325e50d3_elex_mafia_rhadamanthys_stealc_tofsee
Size 1.2MB
Sample250704-p2c8kstms7
SHA256 6c9d39ac05495b902146199a7bb2d8aa42591d98458dee1863bb5fcee2133ce9
MD5 0704c5c3e8c9f888984c9ef3325e50d3
SHA1 4528337f778e5a8fe4da1305cfdb2a52f95f684b
SHA512 bee0a89ca43e7c87daf7f3abb207df4966bb80e6d3ff50980067ef2799518b92e60ba1672947ff096bcc8efd417418213389a79215e636a44c90bd6cf7c6dc36
SSDEEP 24576:9v1Okt3JTNtwAFgxa/ZGSylS12LOxZCiocoEuZ7mZboHZpvti0OAyd:pY43JTNq0gxuGSCj8CiocE6EHzOAA
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

2025-07-04_0704c5c3e8c9f888984c9ef3325e50d3_elex_mafia_rhadamanthys_stealc_tofsee

.exe 1.2MB

2025-07-04_0704c5c3e8c9f888984c9ef3325e50d3_elex_mafia_rhadamanthys_stealc_tofsee

IMPHASH 3aa4cbc9cda646c1b80a8f07b098c12b
SHA256 6c9d39ac05495b902146199a7bb2d8aa42591d98458dee1863bb5fcee2133ce9
MD5 0704c5c3e8c9f888984c9ef3325e50d3
SHA1 4528337f778e5a8fe4da1305cfdb2a52f95f684b
SHA512 bee0a89ca43e7c87daf7f3abb207df4966bb80e6d3ff50980067ef2799518b92e60ba1672947ff096bcc8efd417418213389a79215e636a44c90bd6cf7c6dc36
SSDEEP 24576:9v1Okt3JTNtwAFgxa/ZGSylS12LOxZCiocoEuZ7mZboHZpvti0OAyd:pY43JTNq0gxuGSCj8CiocE6EHzOAA
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

ba:28:e1:76:19:45:52:5c:54:c8:1e:f6:1f:8d:56:ea:41:48:cd:b5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=R2D2 Tech Software LLC,O=R2D2 Tech Software LLC,L=Beaverton,ST=Oregon,C=US

Chains

Jul 7, 2014

Subject

CN=R2D2 Tech Software LLC,O=R2D2 Tech Software LLC,L=Beaverton,ST=Oregon,C=US

Serial Number

72:87:08:9b:c8:0b

Issuer

SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 18, 2013 - Dec 18, 2016

Subject

SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Serial Number

03:01

Issuer

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 16, 2006 - Nov 16, 2026

Subject

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Serial Number

Issuer

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Timespan

Jun 29, 2004 - Jun 29, 2034

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Minor OS version

Major OS version

Entry point

67241

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

OpenMutexA GetCurrentThreadId WaitForSingleObject FlushInstructionCache GetCurrentProcess InterlockedExchange VirtualProtect GetProcessVersion GetProcessHeap GetVersion Sleep GetModuleHandleA OpenEventA CloseHandle CreateMutexA GetNativeSystemInfo GetTickCount VirtualAlloc HeapAlloc VirtualFree HeapFree FreeLibrary GetCommandLineW SetStdHandle WriteConsoleW SetFilePointer ReadFile FlushFileBuffers GetConsoleMode GetConsoleCP InitializeCriticalSection IsValidLocale EnumSystemLocalesA GetCurrentProcessId IsProcessorFeaturePresent GetLastError OpenMutexW GetModuleFileNameA GetDriveTypeA FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetModuleHandleW GetModuleFileNameW GetProcAddress GetLocaleInfoA CreateFileW GetUserDefaultLCID GetStringTypeW MultiByteToWideChar RtlUnwind EncodePointer DecodePointer RaiseException HeapReAlloc HeapSetInformation GetStartupInfoW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapSize ExitProcess GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW HeapCreate HeapDestroy WriteFile GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection QueryPerformanceCounter GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection LoadLibraryW GetLocaleInfoW WideCharToMultiByte

user32

ReleaseDC GetSysColor GetDesktopWindow GetCursor GetSysColorBrush GetSystemMetrics GetFocus GetForegroundWindow GetDC

gdi32

CreateEllipticRgn CreateRoundRectRgn CombineRgn CreateCompatibleDC CreateCompatibleBitmap SelectObject GetStockObject CreatePen Rectangle Ellipse DeleteObject DeleteDC CreateRectRgn

ole32

CoCreateInstance

shlwapi

PathStripToRootA

Sharing

General

Malware Config

Signatures

File Explorer

2025-07-04_0704c5c3e8c9f888984c9ef3325e50d3_elex_mafia_rhadamanthys_stealc_tofsee

PE Signature issue

kernel32

user32

gdi32

ole32

shlwapi

generic