General
- Target 2026-05-11_f3947ad0a3b1226e8c29a225641a7c42_elex_rhadamanthys_stealc_stop_tofsee
- Size 536KB
- Sample260511-tszgnset9x
- SHA256 2f4c3d52592dcf21629d64b33c33e21f8f52abc18ff42774c38c879b4662ebbe
- MD5 f3947ad0a3b1226e8c29a225641a7c42
- SHA1 dc0f7c47d630839453367fad252a69f8b7bcd806
- SHA512 918d16d0516f176c58ce9bc4505a957c6ce520f5f84490d4b19b808db939f9e27ba7ad2f8275eb983dd34719d1995bba2d4c836fe3f8ea48bf500c23833cd9f2
- SSDEEP 12288:3p3pg/994wznStojPy0UfJHCw1d/GNOoMm0Z:3p3pM94wzkojPyTH6M5Z
- TLSH T187C4E02E7080C03BD167DA348ED2D2756A79BC215829898FFBCD776F1F30291AB19356
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-05-11_f3947ad0a3b1226e8c29a225641a7c42_elex_rhadamanthys_stealc_stop_tofsee.exe
Resource
win10v2004-20260130-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-11_f3947ad0a3b1226e8c29a225641a7c42_elex_rhadamanthys_stealc_stop_tofsee.exe
Resource
win11-20250502-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-11_f3947ad0a3b1226e8c29a225641a7c42_elex_rhadamanthys_stealc_stop_tofsee
- Size 536KB
- SHA256 2f4c3d52592dcf21629d64b33c33e21f8f52abc18ff42774c38c879b4662ebbe
- MD5 f3947ad0a3b1226e8c29a225641a7c42
- SHA1 dc0f7c47d630839453367fad252a69f8b7bcd806
- SHA512 918d16d0516f176c58ce9bc4505a957c6ce520f5f84490d4b19b808db939f9e27ba7ad2f8275eb983dd34719d1995bba2d4c836fe3f8ea48bf500c23833cd9f2
- SSDEEP 12288:3p3pg/994wznStojPy0UfJHCw1d/GNOoMm0Z:3p3pM94wzkojPyTH6M5Z
- TLSH T187C4E02E7080C03BD167DA348ED2D2756A79BC215829898FFBCD776F1F30291AB19356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Drops desktop.ini file(s)
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
1