2026-06-25_5047a6461b0f0af73121f34cd4c174f2_elex_karagany_rhadamanthys_stop

General

Target
2026-06-25_5047a6461b0f0af73121f34cd4c174f2_elex_karagany_rhadamanthys_stop
Size 5.7MB
Sample260629-2ecpragx5s
SHA256 fba4d53dc3b371b6379a00061ee9d1f27796025eeb157f1553ac6c1e1eb4a18d
MD5 5047a6461b0f0af73121f34cd4c174f2
SHA1 3e890bc1545339f18f6a969a13cf82647e6c0bf0
SHA512 aa6e8737598e9e6bb5c522e5b3bec477fc5fd53f9d4b5f76cda266a272386545d62dcdafd0ed2ad951a9fefecd0d8722e19a661667e7cbfb0e7319255c077056
SSDEEP 98304:d3Zm98WL2zlbqSNzkSwFCSXMcKGXXxItI/ITPAJhLhHGTsPrCyc9i6Mlg2fGFNV:NpXbHqJXsOE4XhOUkinlgUGrV
TLSH
T1CB563300FAD011F0C6EB5C354CF99A920A76BE5688D6E98729F0FB017C31C919769B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-25_5047a6461b0f0af73121f34cd4c174f2_elex_karagany_rhadamanthys_stop

File Explorer

2026-06-25_5047a6461b0f0af73121f34cd4c174f2_elex_karagany_rhadamanthys_stop

.exe 5.7MB

2026-06-25_5047a6461b0f0af73121f34cd4c174f2_elex_karagany_rhadamanthys_stop

IMPHASH 9b0974e10a21ff44f065d582c0872e7e
SHA256 fba4d53dc3b371b6379a00061ee9d1f27796025eeb157f1553ac6c1e1eb4a18d
MD5 5047a6461b0f0af73121f34cd4c174f2
SHA1 3e890bc1545339f18f6a969a13cf82647e6c0bf0
SHA512 aa6e8737598e9e6bb5c522e5b3bec477fc5fd53f9d4b5f76cda266a272386545d62dcdafd0ed2ad951a9fefecd0d8722e19a661667e7cbfb0e7319255c077056
SSDEEP 98304:d3Zm98WL2zlbqSNzkSwFCSXMcKGXXxItI/ITPAJhLhHGTsPrCyc9i6Mlg2fGFNV:NpXbHqJXsOE4XhOUkinlgUGrV
TLSH
T1CB563300FAD011F0C6EB5C354CF99A920A76BE5688D6E98729F0FB017C31C919769B6F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

11641

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InitializeCriticalSectionAndSpinCount LockResource GetProcAddress VirtualAlloc GetLastError LoadResource SizeofResource GetFileSize WriteFile ReadFile CloseHandle LoadLibraryA GetModuleFileNameW GetModuleHandleW CreateProcessW GetEnvironmentVariableW SetEnvironmentVariableW FindResourceW FindResourceExW GetTempPathW GetTempFileNameW CreateFileW DeleteFileW MultiByteToWideChar WideCharToMultiByte GetCommandLineW HeapFree GetSystemTimeAsFileTime RaiseException RtlUnwind SetLastError InterlockedIncrement InterlockedDecrement GetCurrentThreadId EncodePointer DecodePointer ExitProcess GetModuleHandleExW GetStdHandle GetProcessHeap GetFileType DeleteCriticalSection GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree IsProcessorFeaturePresent IsDebuggerPresent HeapAlloc HeapReAlloc HeapSize EnterCriticalSection LeaveCriticalSection Sleep IsValidCodePage GetACP GetOEMCP GetCPInfo LoadLibraryExW OutputDebugStringW LoadLibraryW GetStringTypeW LCMapStringW FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx SetStdHandle WriteConsoleW HeapDestroy

shell32

ShellExecuteW

shlwapi

PathRenameExtensionW PathFileExistsW

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-25_5047a6461b0f0af73121f34cd4c174f2_elex_karagany_rhadamanthys_stop

kernel32

shell32

shlwapi

generic