Overview

overview

10

Static

static

10

2026-05-27...ys.exe

windows10-2004-x64

3

2026-05-27...ys.exe

windows11-21h2-x64

3

$PLUGINSDI...st.dll

windows10-2004-x64

3

$PLUGINSDI...st.dll

windows11-21h2-x64

3

$PLUGINSDI...in.dll

windows10-2004-x64

3

$PLUGINSDI...in.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...86.dll

windows10-2004-x64

3

$PLUGINSDI...86.dll

windows11-21h2-x64

3

$_54_/13.7...re.exe

windows10-2004-x64

6

$_54_/13.7...re.exe

windows11-21h2-x64

6

$_54_/13.7...pp.dll

windows10-2004-x64

8

$_54_/13.7...pp.dll

windows11-21h2-x64

8

$_54_/13.7...LL.dll

windows10-2004-x64

9

$_54_/13.7...LL.dll

windows11-21h2-x64

9

$_54_/13.7...64.dll

windows10-2004-x64

9

$_54_/13.7...64.dll

windows11-21h2-x64

9

$_54_/13.7...st.exe

windows10-2004-x64

3

$_54_/13.7...st.exe

windows11-21h2-x64

3

$_54_/13.7...dm.dll

windows10-2004-x64

3

$_54_/13.7...dm.dll

windows11-21h2-x64

3

$_54_/Prot...er.exe

windows10-2004-x64

3

$_54_/Prot...er.exe

windows11-21h2-x64

4

$_54_/Prot...in.dll

windows10-2004-x64

3

$_54_/Prot...in.dll

windows11-21h2-x64

3

$_54_/Prot...ce.dll

windows10-2004-x64

3

$_54_/Prot...ce.dll

windows11-21h2-x64

3

$_54_/Prot...ce.exe

windows10-2004-x64

3

$_54_/Prot...ce.exe

windows11-21h2-x64

3

$_54_/Prot...er.exe

windows10-2004-x64

3

$_54_/Prot...er.exe

windows11-21h2-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-05-27_0cdba1b04e2f226718ef678638d0ee6f_elex_maze_rhadamanthys
  • Size 14.6MB
  • Sample260527-3tkvcads61
  • SHA256 2c2c1c9506e2bc1db148de3b9d637338931604af714c0750411dcb50a35f0870
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryspywaretrojanupx

Malware Config

Targets

    • Target
      2026-05-27_0cdba1b04e2f226718ef678638d0ee6f_elex_maze_rhadamanthys
    • Size 14.6MB
    • SHA256 2c2c1c9506e2bc1db148de3b9d637338931604af714c0750411dcb50a35f0870
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral1behavioral2
    • Target
      $PLUGINSDIR/Assist.dll
    • Size 1.2MB
    • SHA256 802f344643ad2ae5fc907f2c734b13341fdd21d8d82b39e1f2116417e642a7f9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/RCWidgetPlugin.dll
    • Size 3.2MB
    • SHA256 822252bb5c5e0fd572d95a302e20e810a0d99191a79bf1010eeb67963dc306ca
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/System.dll
    • Size 33KB
    • SHA256 d99ab4b1a24c00d6367a45148183228f33e89ee943494d0456c519435c0e5842
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/libcurl_x86.dll
    • Size 2.8MB
    • SHA256 5e99492341fdb5ef86ba7379565b8e7f7b4412b87947a26eb0522a13bb0ed100
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral10behavioral9
    • Target
      $_54_/13.7.0.41868/Assistant/2345Capture.exe
    • Size 394KB
    • SHA256 15df1d4f3e634a077ed2e874c2d974928cfc73c6805dc3a72b7433e393b1cfb9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    defense_evasiondiscoveryspywaretrojan

    • Downloads MZ/PE file

    behavioral11behavioral12
    • Target
      $_54_/13.7.0.41868/Assistant/2345CaptureApp.dll
    • Size 2.3MB
    • SHA256 29faaea63a0772a9410857ae4d9175f050e5136bb049cb62902c5e1cd91a5b1a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    discovery

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    behavioral13behavioral14
    • Target
      $_54_/13.7.0.41868/Assistant/2345MgrDLL.dll
    • Size 1.7MB
    • SHA256 537bac863153ce4f18c0c7da6e98d47af94e42f46397044697e01e6db0296f08
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    9/10
    discoveryupx

    • Detects executables referencing combination of virtualization drivers

    • UPX dump on OEP (original entry point)

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral15behavioral16
    • Target
      $_54_/13.7.0.41868/Assistant/2345MgrDLL64.dll
    • Size 2.1MB
    • SHA256 b5b38be381232481a3b5b59518b3a278d4415b2a18280f0950040db5d21a8d7e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    9/10
    upx

    • Detects executables referencing combination of virtualization drivers

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral17behavioral18
    • Target
      $_54_/13.7.0.41868/Assistant/2345Uninst.exe
    • Size 431KB
    • SHA256 f7d55a942604957a6ca63655b0e35e349613008ea2bcf97a23988cbfd6d0ae77
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral19behavioral20
    • Target
      $_54_/13.7.0.41868/WidevineCdm/_platform_specific/win_x86/widevinecdm.dll
    • Size 9.9MB
    • SHA256 35cf7389ab7b5badc6d0c8ffeb3398e89782e05d0332bf28d3b0dd215da35a9e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral21behavioral22
    • Target
      $_54_/Protect/AssistExplorer.exe
    • Size 1.2MB
    • SHA256 c259e71d2c81a31e165be36fdc07efb68ed741a947b84bcd75ad3253c824b023
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    discovery
    behavioral23behavioral24
    • Target
      $_54_/Protect/AssistMain.dll
    • Size 3.0MB
    • SHA256 f0a0f280fbed17e523dd3417f0274d3a3d74eb59f42ab8ed15e105471fade759
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral25behavioral26
    • Target
      $_54_/Protect/BrowserService.dll
    • Size 1.4MB
    • SHA256 23484755ecb27a961aa360ed28b84ae314a9f534b89dffe9cab808dede44179a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral27behavioral28
    • Target
      $_54_/Protect/BrowserService.exe
    • Size 205KB
    • SHA256 98a2c2b1c245dc3f0484225289211f4bffcd91ff27b87f78c4b37a2947967bcc
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral29behavioral30
    • Target
      $_54_/Protect/BrowserServiceManager.exe
    • Size 533KB
    • SHA256 25128bbddbb95585ab5dd4750b8a668c8814284a1c935f2dd843381c0cd33f48
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Tasks

static1

upx
Score
10/10

behavioral1

discovery
Score
3/10

behavioral2

discovery
Score
3/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

defense_evasiondiscoveryspywaretrojan
Score
6/10

behavioral12

defense_evasiondiscoveryspywaretrojan
Score
6/10

behavioral13

discovery
Score
8/10

behavioral14

discovery
Score
8/10

behavioral15

discoveryupx
Score
9/10

behavioral16

discoveryupx
Score
9/10

behavioral17

upx
Score
9/10

behavioral18

upx
Score
9/10

behavioral19

discovery
Score
3/10

behavioral20

discovery
Score
3/10

behavioral21

discovery
Score
3/10

behavioral22

discovery
Score
3/10

behavioral23

discovery
Score
3/10

behavioral24

discovery
Score
4/10

behavioral25

discovery
Score
3/10

behavioral26

discovery
Score
3/10

behavioral27

discovery
Score
3/10

behavioral28

discovery
Score
3/10

behavioral29

discovery
Score
3/10

behavioral30

discovery
Score
3/10

behavioral31

discovery
Score
3/10

behavioral32

discovery
Score
3/10