General
- Target 2026-05-11_6df97332d2a1a9f3fcc4e38133b0a47a_elex_rhadamanthys_stealc_stop_tofsee
- Size 536KB
- Sample260511-11axlsa171
- SHA256 af13b916c47628532d2b49234a6f4a681da280e3f80f07e4e566cba6da22baf7
- MD5 6df97332d2a1a9f3fcc4e38133b0a47a
- SHA1 6d740f4fe6f0fa2a1c8cdfb761fd4ec4659454b2
- SHA512 15abe35048e5cd1341793a6fc968185fc46fdc847e4ba52c6d74b8c9d8795ba1f30b8ed0cef2e1cde0a5cadaabb1c7927689437d93e6afc91d6e4d3cd05e53d9
- SSDEEP 12288:bj5Fnmpxkhzu/AIEyaq+hy2gPKHZiFtJhZr9:bj5Fgxkhz/IEyshJMJr9
- TLSH T11DC4F02E7090C03BD263DA348ED2E2715A79BC615829858FFBCD776F2F302919B19356
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-05-11_6df97332d2a1a9f3fcc4e38133b0a47a_elex_rhadamanthys_stealc_stop_tofsee.exe
Resource
win10v2004-20260130-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-11_6df97332d2a1a9f3fcc4e38133b0a47a_elex_rhadamanthys_stealc_stop_tofsee.exe
Resource
win11-20260130-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-11_6df97332d2a1a9f3fcc4e38133b0a47a_elex_rhadamanthys_stealc_stop_tofsee
- Size 536KB
- SHA256 af13b916c47628532d2b49234a6f4a681da280e3f80f07e4e566cba6da22baf7
- MD5 6df97332d2a1a9f3fcc4e38133b0a47a
- SHA1 6d740f4fe6f0fa2a1c8cdfb761fd4ec4659454b2
- SHA512 15abe35048e5cd1341793a6fc968185fc46fdc847e4ba52c6d74b8c9d8795ba1f30b8ed0cef2e1cde0a5cadaabb1c7927689437d93e6afc91d6e4d3cd05e53d9
- SSDEEP 12288:bj5Fnmpxkhzu/AIEyaq+hy2gPKHZiFtJhZr9:bj5Fgxkhz/IEyshJMJr9
- TLSH T11DC4F02E7090C03BD263DA348ED2E2715A79BC615829858FFBCD776F2F302919B19356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Drops desktop.ini file(s)
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
1