General
- Target 2026-05-09_95c974fca8c602170dcaf63ae0d390e7_elex_rhadamanthys_stealc_stop_tofsee
- Size 521KB
- Sample260509-ehel7aav31
- SHA256 274a01c844a20bd5ee7cc8bbedabd9393615cbe5adddc9600b398bc377a228b0
- MD5 95c974fca8c602170dcaf63ae0d390e7
- SHA1 7dd249b61d9ec2b1279ebc827bb9f3ab003554c4
- SHA512 d42b22e49f6edc348d2c1b919dc3e9bd7dbe5a160bd7a02a3a1a11b906ec91eff03414791ed9d3d769eda4df162e545830ee9719915b07395fc5ae82da3e927a
- SSDEEP 12288:Nm3DNflT4tzPVMIWim510b2wvI41nLrXwykp:Nm3DzT4tzqIWiD2QVFkp
- TLSH T1D6B4F13B7480C037D17716348DD2D275AA7ABC29583A858B7BCA477E2F30293DB1935A
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-05-09_95c974fca8c602170dcaf63ae0d390e7_elex_rhadamanthys_stealc_stop_tofsee.exe
Resource
win10v2004-20260130-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-09_95c974fca8c602170dcaf63ae0d390e7_elex_rhadamanthys_stealc_stop_tofsee.exe
Resource
win11-20260130-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-09_95c974fca8c602170dcaf63ae0d390e7_elex_rhadamanthys_stealc_stop_tofsee
- Size 521KB
- SHA256 274a01c844a20bd5ee7cc8bbedabd9393615cbe5adddc9600b398bc377a228b0
- MD5 95c974fca8c602170dcaf63ae0d390e7
- SHA1 7dd249b61d9ec2b1279ebc827bb9f3ab003554c4
- SHA512 d42b22e49f6edc348d2c1b919dc3e9bd7dbe5a160bd7a02a3a1a11b906ec91eff03414791ed9d3d769eda4df162e545830ee9719915b07395fc5ae82da3e927a
- SSDEEP 12288:Nm3DNflT4tzPVMIWim510b2wvI41nLrXwykp:Nm3DzT4tzqIWiD2QVFkp
- TLSH T1D6B4F13B7480C037D17716348DD2D275AA7ABC29583A858B7BCA477E2F30293DB1935A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Drops desktop.ini file(s)
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
1