General
- Target 2026-05-09_f44fd051468509022b2f76698547bf42_elex_mafia_rhadamanthys_stealc_stop_tofsee
- Size 500KB
- Sample260509-emmtcsav7x
- SHA256 6caf0368366df4deeeaa28dfec1f5c20725d89001f1048c02870bc9fee5ef2bf
- MD5 f44fd051468509022b2f76698547bf42
- SHA1 42c89c226645cc44fbdabdfa7611a5f832355731
- SHA512 059151565a6d2a83312dee12b08b3f53e85c57815c33e1eca48cec6d8b930a4bb657250ad7ff92baa8c572c092ab70488bdcd1cc11f13fd70411bcc91ae4dd33
- SSDEEP 12288:gbEqkIX9IoqwhJmWYUXBDcLP7jGKk1XKdsKFWY:gbRk++whzBIP7jCJY
- TLSH T1BFB4DF3A245C80F7D22616B489C2A2F3F7ACB8A1552C557727CB4E3B1E20395B717E1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-05-09_f44fd051468509022b2f76698547bf42_elex_mafia_rhadamanthys_stealc_stop_tofsee.exe
Resource
win10v2004-20260130-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-09_f44fd051468509022b2f76698547bf42_elex_mafia_rhadamanthys_stealc_stop_tofsee.exe
Resource
win11-20260130-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-09_f44fd051468509022b2f76698547bf42_elex_mafia_rhadamanthys_stealc_stop_tofsee
- Size 500KB
- SHA256 6caf0368366df4deeeaa28dfec1f5c20725d89001f1048c02870bc9fee5ef2bf
- MD5 f44fd051468509022b2f76698547bf42
- SHA1 42c89c226645cc44fbdabdfa7611a5f832355731
- SHA512 059151565a6d2a83312dee12b08b3f53e85c57815c33e1eca48cec6d8b930a4bb657250ad7ff92baa8c572c092ab70488bdcd1cc11f13fd70411bcc91ae4dd33
- SSDEEP 12288:gbEqkIX9IoqwhJmWYUXBDcLP7jGKk1XKdsKFWY:gbRk++whzBIP7jCJY
- TLSH T1BFB4DF3A245C80F7D22616B489C2A2F3F7ACB8A1552C557727CB4E3B1E20395B717E1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Drops desktop.ini file(s)
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
1