General
- Target 2026-05-06_378a1d86cbe99cdbb9271b3c421a3e5c_elex_rhadamanthys_stealc_stop_tofsee
- Size 536KB
- Sample260506-ph549aev4k
- SHA256 44f8ff8b58a348197d2bce9d2cb42af7dc67056ef42e128193fd8ea67e4fadb9
- MD5 378a1d86cbe99cdbb9271b3c421a3e5c
- SHA1 bb47bb8c0fa391a5031eb9e7ba84b2d516285551
- SHA512 0b906b806bbda729974f8351a12dd3b389a8ba30f8befb0a2aebdb397420da5b7048308ad8a20ac60c28816f4dab82d0d56c039508c9d323c6ba631c39c8be03
- SSDEEP 12288:4p3pg/994wznStojPy0UfJHCw1d/GNOoMm01:4p3pM94wzkojPyTH6M51
- TLSH T154C4E02E7080C03BD167DA348ED2D2756A79BC215829898FFBCD776F1F30291AB19356
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-05-06_378a1d86cbe99cdbb9271b3c421a3e5c_elex_rhadamanthys_stealc_stop_tofsee.exe
Resource
win10v2004-20260130-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-06_378a1d86cbe99cdbb9271b3c421a3e5c_elex_rhadamanthys_stealc_stop_tofsee.exe
Resource
win11-20260130-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-06_378a1d86cbe99cdbb9271b3c421a3e5c_elex_rhadamanthys_stealc_stop_tofsee
- Size 536KB
- SHA256 44f8ff8b58a348197d2bce9d2cb42af7dc67056ef42e128193fd8ea67e4fadb9
- MD5 378a1d86cbe99cdbb9271b3c421a3e5c
- SHA1 bb47bb8c0fa391a5031eb9e7ba84b2d516285551
- SHA512 0b906b806bbda729974f8351a12dd3b389a8ba30f8befb0a2aebdb397420da5b7048308ad8a20ac60c28816f4dab82d0d56c039508c9d323c6ba631c39c8be03
- SSDEEP 12288:4p3pg/994wznStojPy0UfJHCw1d/GNOoMm01:4p3pM94wzkojPyTH6M51
- TLSH T154C4E02E7080C03BD167DA348ED2D2756A79BC215829898FFBCD776F1F30291AB19356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Drops desktop.ini file(s)
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
1