firseria | 2026-05-11_f3947ad0a3b1226e8c29a225641a7c42_elex_rhadamanthys_stealc_stop_tofsee

General

Target
2026-05-11_f3947ad0a3b1226e8c29a225641a7c42_elex_rhadamanthys_stealc_stop_tofsee
Size 536KB
Sample260511-tszgnset9x
SHA256 2f4c3d52592dcf21629d64b33c33e21f8f52abc18ff42774c38c879b4662ebbe
MD5 f3947ad0a3b1226e8c29a225641a7c42
SHA1 dc0f7c47d630839453367fad252a69f8b7bcd806
SHA512 918d16d0516f176c58ce9bc4505a957c6ce520f5f84490d4b19b808db939f9e27ba7ad2f8275eb983dd34719d1995bba2d4c836fe3f8ea48bf500c23833cd9f2
SSDEEP 12288:3p3pg/994wznStojPy0UfJHCw1d/GNOoMm0Z:3p3pM94wzkojPyTH6M5Z
TLSH
T187C4E02E7080C03BD167DA348ED2D2756A79BC215829898FFBCD776F1F30291AB19356
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: Firseria
Firseria a downloader/adware written in C++.
downloader adware firseria

Detects Firseria 1 IoCs

downloader adware

resource	yara_rule
sample	family_firseria

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-11_f3947ad0a3b1226e8c29a225641a7c42_elex_rhadamanthys_stealc_stop_tofsee

2026-05-11_f3947ad0a3b1226e8c29a225641a7c42_elex_rhadamanthys_stealc_stop_tofsee

.exe 536KB

SHA256 2f4c3d52592dcf21629d64b33c33e21f8f52abc18ff42774c38c879b4662ebbe
MD5 f3947ad0a3b1226e8c29a225641a7c42
SHA1 dc0f7c47d630839453367fad252a69f8b7bcd806
SHA512 918d16d0516f176c58ce9bc4505a957c6ce520f5f84490d4b19b808db939f9e27ba7ad2f8275eb983dd34719d1995bba2d4c836fe3f8ea48bf500c23833cd9f2
SSDEEP 12288:3p3pg/994wznStojPy0UfJHCw1d/GNOoMm0Z:3p3pM94wzkojPyTH6M5Z
TLSH
T187C4E02E7080C03BD167DA348ED2D2756A79BC215829898FFBCD776F1F30291AB19356
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

1

Major OS version

5

Entry point

62827

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths