General
- Target 2026-05-11_e7ae297692fdb1f47c87c1e6e4a14a28_elex_rhadamanthys_stealc_stop_tofsee
- Size 537KB
- Sample260511-vmcamaax5m
- SHA256 6904ac55f3c1851e92e893330f01740d5a507cc28d45e2a551eec442ffe5c1d5
- MD5 e7ae297692fdb1f47c87c1e6e4a14a28
- SHA1 9cd5141780d8f360ca3e12aedd67db9271cd2ded
- SHA512 0046385e1d0a077e292f555be0a61e26c258d902ecd7e1e5236069ad53c8374a043945e0523286353f88920dd4247315ae06b7dd00d86bcb8bf8cd943f226feb
- SSDEEP 12288:pp3pg/994wznStojPy0UfJHCw1d/GNOoMm0b:pp3pM94wzkojPyTH6M5b
- TLSH T135C4E02E7090C03BD167D9348ED2D2756A79BC215829898FFBCD776F1F30291AB09356
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-05-11_e7ae297692fdb1f47c87c1e6e4a14a28_elex_rhadamanthys_stealc_stop_tofsee.exe
Resource
win10v2004-20260130-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-11_e7ae297692fdb1f47c87c1e6e4a14a28_elex_rhadamanthys_stealc_stop_tofsee.exe
Resource
win11-20260130-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-11_e7ae297692fdb1f47c87c1e6e4a14a28_elex_rhadamanthys_stealc_stop_tofsee
- Size 537KB
- SHA256 6904ac55f3c1851e92e893330f01740d5a507cc28d45e2a551eec442ffe5c1d5
- MD5 e7ae297692fdb1f47c87c1e6e4a14a28
- SHA1 9cd5141780d8f360ca3e12aedd67db9271cd2ded
- SHA512 0046385e1d0a077e292f555be0a61e26c258d902ecd7e1e5236069ad53c8374a043945e0523286353f88920dd4247315ae06b7dd00d86bcb8bf8cd943f226feb
- SSDEEP 12288:pp3pg/994wznStojPy0UfJHCw1d/GNOoMm0b:pp3pM94wzkojPyTH6M5b
- TLSH T135C4E02E7090C03BD167D9348ED2D2756A79BC215829898FFBCD776F1F30291AB09356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Drops desktop.ini file(s)
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
1