2026-04-23_6978cb65955c7815a4658643765a6574_elex_karagany_rhadamanthys_stop

General

Target
2026-04-23_6978cb65955c7815a4658643765a6574_elex_karagany_rhadamanthys_stop
Size 5.7MB
Sample260423-a77xtae181
SHA256 01bad45418708ba8b1c6f2523c86f32941909bb33f65cba0e3a6e69a95734a48
MD5 6978cb65955c7815a4658643765a6574
SHA1 5cc1d12316cac58625c5539ae81f5f461e93c975
SHA512 62eaf386a178d2578c026a252cc2ceb8ccf4502d61e03b1254f7bec7b1a0dad7ec484d19e64282def668c0fad32f558cbd7ef5fb7c02cc28a38ef8063ae7a2d5
SSDEEP 98304:OAZmwZm98WL2zlbqSNzkSwFCSXMcKGXXxItI/ITPAJhLhHGTsPrCyc9i6Mlg2fGB:ORwpXbHqJXsOE4XhOUkinlgUGrV
TLSH
T1EF563340FAD010E0C2EB5C314DF96AD206B66E86C8D5F98735E4BB017C71D919B2DAAF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-23_6978cb65955c7815a4658643765a6574_elex_karagany_rhadamanthys_stop

File Explorer

2026-04-23_6978cb65955c7815a4658643765a6574_elex_karagany_rhadamanthys_stop

.exe 5.7MB

2026-04-23_6978cb65955c7815a4658643765a6574_elex_karagany_rhadamanthys_stop

IMPHASH 9b0974e10a21ff44f065d582c0872e7e
SHA256 01bad45418708ba8b1c6f2523c86f32941909bb33f65cba0e3a6e69a95734a48
MD5 6978cb65955c7815a4658643765a6574
SHA1 5cc1d12316cac58625c5539ae81f5f461e93c975
SHA512 62eaf386a178d2578c026a252cc2ceb8ccf4502d61e03b1254f7bec7b1a0dad7ec484d19e64282def668c0fad32f558cbd7ef5fb7c02cc28a38ef8063ae7a2d5
SSDEEP 98304:OAZmwZm98WL2zlbqSNzkSwFCSXMcKGXXxItI/ITPAJhLhHGTsPrCyc9i6Mlg2fGB:ORwpXbHqJXsOE4XhOUkinlgUGrV
TLSH
T1EF563340FAD010E0C2EB5C314DF96AD206B66E86C8D5F98735E4BB017C71D919B2DAAF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

11641

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InitializeCriticalSectionAndSpinCount LockResource GetProcAddress VirtualAlloc GetLastError LoadResource SizeofResource GetFileSize WriteFile ReadFile CloseHandle LoadLibraryA GetModuleFileNameW GetModuleHandleW CreateProcessW GetEnvironmentVariableW SetEnvironmentVariableW FindResourceW FindResourceExW GetTempPathW GetTempFileNameW CreateFileW DeleteFileW MultiByteToWideChar WideCharToMultiByte GetCommandLineW HeapFree GetSystemTimeAsFileTime RaiseException RtlUnwind SetLastError InterlockedIncrement InterlockedDecrement GetCurrentThreadId EncodePointer DecodePointer ExitProcess GetModuleHandleExW GetStdHandle GetProcessHeap GetFileType DeleteCriticalSection GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree IsProcessorFeaturePresent IsDebuggerPresent HeapAlloc HeapReAlloc HeapSize EnterCriticalSection LeaveCriticalSection Sleep IsValidCodePage GetACP GetOEMCP GetCPInfo LoadLibraryExW OutputDebugStringW LoadLibraryW GetStringTypeW LCMapStringW FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx SetStdHandle WriteConsoleW HeapDestroy

shell32

ShellExecuteW

shlwapi

PathRenameExtensionW PathFileExistsW

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-23_6978cb65955c7815a4658643765a6574_elex_karagany_rhadamanthys_stop

kernel32

shell32

shlwapi

generic