ee55d81219b1b9a04137e772cb5da083601f01487e97f2bdd9162966c7f95d5f

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-30_2554d4b3678a5786101c7ef1dd96922a_elex_maze_rhadamanthys
Size 1.9MB
Sample260701-acy2escs61
SHA256 ee55d81219b1b9a04137e772cb5da083601f01487e97f2bdd9162966c7f95d5f
MD5 2554d4b3678a5786101c7ef1dd96922a
SHA1 997538a9eae16142d13dfeadc32f6119253bb45d
SHA512 05c37e51a4c4cc3c8ea9d83d56b4a3e746a5a00f7ad33b7f2d1de487a34511f53800896541452c7380aee1c741386f6a1364589505484b0177c70579bcc8f4b5
SSDEEP 49152:1iSM/m5YbaNcLqDjxEAV8TvH5JzcPGQ6ek65z:QDm1jjmA+5JzcuQN7z
TLSH
T17D953378A3A808F2D53209B643BE9B8366761D3137E454E3637C7A957A331D1E23DB90
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  2026-06-30_2554d4b3678a5786101c7ef1dd96922a_elex_maze_rhadamanthys
- Size 1.9MB
- SHA256 ee55d81219b1b9a04137e772cb5da083601f01487e97f2bdd9162966c7f95d5f
- MD5 2554d4b3678a5786101c7ef1dd96922a
- SHA1 997538a9eae16142d13dfeadc32f6119253bb45d
- SHA512 05c37e51a4c4cc3c8ea9d83d56b4a3e746a5a00f7ad33b7f2d1de487a34511f53800896541452c7380aee1c741386f6a1364589505484b0177c70579bcc8f4b5
- SSDEEP 49152:1iSM/m5YbaNcLqDjxEAV8TvH5JzcPGQ6ek65z:QDm1jjmA+5JzcuQN7z
- TLSH
  T17D953378A3A808F2D53209B643BE9B8366761D3137E454E3637C7A957A331D1E23DB90
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/Assist.dll
- Size 1.2MB
- SHA256 802f344643ad2ae5fc907f2c734b13341fdd21d8d82b39e1f2116417e642a7f9
- MD5 7de30dac5d4c3bc2f15fded711aa7cf5
- SHA1 732987eddf2085f4970c9b1bf7eccc878fd93aaa
- SHA512 693557660b0f094cf3aafc816b9dcf5f1c72d3641db4b142aa0c7d7067a25fe2a7b6d498b88e3dc7a1c5a79d907f43bdbcb578af64ae69b6db79e492072b3300
- SSDEEP 24576:l5zq1y3LlQMybGzsdUJWGHlCJrbBbogT8rqlH4TGrZ:jWkJ2azO28rVbLTGqZ4TGd
- TLSH
  T14F454A21A645C377E56D11B0172C9E6E502C75312B6088CBF3C52F6A29F0ED26637FAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  $PLUGINSDIR/RCWidgetPlugin.dll
- Size 1.1MB
- SHA256 d85f7d03765eaaf31e0d8d6ef77f4894a4d54d33f4c49abebfa8e3cad55882dc
- MD5 c3b4896ece0a20de651fc6d42241f2ae
- SHA1 c31648a4ca79621caa0c5cdc53054dab3fe44159
- SHA512 95497ce8c0dbb791833d0a5914d7ee73d41546ef4b403101d2de55336d161c304e1b00caa5c1a0f337fbc03065d55083206f8eba513af6231ae131a1297d285d
- SSDEEP 24576:G3Bj94iC8aWxbHfeZU1hDmD62mGBRjAZB:GBC8aoKF4
- TLSH
  T1BC451A2193068B67D98915F0AB2D5E6F501C7A2837A458C3F3C85F2628E1DD36B33E5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 33KB
- SHA256 d99ab4b1a24c00d6367a45148183228f33e89ee943494d0456c519435c0e5842
- MD5 588fd9fe5e2863d0c3997eb8d7baa4bb
- SHA1 6be2371ce245f8af5eba3a22ace8489bfb9d7995
- SHA512 be412336fcd8f144990e3740036fb9b39bb605eb938879118fe47c0fcec5f7e741cb60efdd2fb058e9bc7b97db226f1160304d20b0ae1ee2282173c9928d2a60
- SSDEEP 384:8xoXlBT3SaMINWf52+4kb1VBNyT8E9VF3ZJ5PxWnRWVolCZsHLIaPxh8E9VF0Nyl:8ypSvIWb3JVErPxAlfTPxWEQT+J
- TLSH
  T1CDE25C129B546CF1ED9A4E3530E8E92B6E30B7915BD1C5E3576AC0005B913C37AF82EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  $PLUGINSDIR/libcurl_x86.dll
- Size 2.8MB
- SHA256 5e99492341fdb5ef86ba7379565b8e7f7b4412b87947a26eb0522a13bb0ed100
- MD5 940c40feb0f6fe025298748f5901930a
- SHA1 c05dc39a537cef090c6120b54d313dfa9092ed68
- SHA512 2b0ffbc5b40b935eb57ec4bbff22e6137c602de5bf8ff9a3aeda245f25f2349b38402de49fcdf19547f0ed63d64a656e8db617d3e2dec94868c8988049192a33
- SSDEEP 49152:a+qw+WcbiTL8zYG4CwrX2/oDqQDX7UMfSPTD/9z9Iyj:a+qwAiTL8z22yTX7pfUD/9
- TLSH
  T1FAD5AE13FB828472E9DA017961BB977F4E3E5A109328C9C387A129B59E301D1773F399
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $_54_/Protect/libcurl_x86.dll
- Size 2.8MB
- SHA256 5e99492341fdb5ef86ba7379565b8e7f7b4412b87947a26eb0522a13bb0ed100
- MD5 940c40feb0f6fe025298748f5901930a
- SHA1 c05dc39a537cef090c6120b54d313dfa9092ed68
- SHA512 2b0ffbc5b40b935eb57ec4bbff22e6137c602de5bf8ff9a3aeda245f25f2349b38402de49fcdf19547f0ed63d64a656e8db617d3e2dec94868c8988049192a33
- SSDEEP 49152:a+qw+WcbiTL8zYG4CwrX2/oDqQDX7UMfSPTD/9z9Iyj:a+qwAiTL8z22yTX7pfUD/9
- TLSH
  T1FAD5AE13FB828472E9DA017961BB977F4E3E5A109328C9C387A129B59E301D1773F399
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $_63_/$_63_/libcurl_x86.dll
- Size 2.8MB
- SHA256 5e99492341fdb5ef86ba7379565b8e7f7b4412b87947a26eb0522a13bb0ed100
- MD5 940c40feb0f6fe025298748f5901930a
- SHA1 c05dc39a537cef090c6120b54d313dfa9092ed68
- SHA512 2b0ffbc5b40b935eb57ec4bbff22e6137c602de5bf8ff9a3aeda245f25f2349b38402de49fcdf19547f0ed63d64a656e8db617d3e2dec94868c8988049192a33
- SSDEEP 49152:a+qw+WcbiTL8zYG4CwrX2/oDqQDX7UMfSPTD/9z9Iyj:a+qwAiTL8z22yTX7pfUD/9
- TLSH
  T1FAD5AE13FB828472E9DA017961BB977F4E3E5A109328C9C387A129B59E301D1773F399
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $_63_/13.7.0.41868/$_63_/13.7.0.41868/libcurl_x86.dll
- Size 2.8MB
- SHA256 5e99492341fdb5ef86ba7379565b8e7f7b4412b87947a26eb0522a13bb0ed100
- MD5 940c40feb0f6fe025298748f5901930a
- SHA1 c05dc39a537cef090c6120b54d313dfa9092ed68
- SHA512 2b0ffbc5b40b935eb57ec4bbff22e6137c602de5bf8ff9a3aeda245f25f2349b38402de49fcdf19547f0ed63d64a656e8db617d3e2dec94868c8988049192a33
- SSDEEP 49152:a+qw+WcbiTL8zYG4CwrX2/oDqQDX7UMfSPTD/9z9Iyj:a+qwAiTL8z22yTX7pfUD/9
- TLSH
  T1FAD5AE13FB828472E9DA017961BB977F4E3E5A109328C9C387A129B59E301D1773F399
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  13.7.0.41868/libcurl_x86.dll
- Size 2.8MB
- SHA256 5e99492341fdb5ef86ba7379565b8e7f7b4412b87947a26eb0522a13bb0ed100
- MD5 940c40feb0f6fe025298748f5901930a
- SHA1 c05dc39a537cef090c6120b54d313dfa9092ed68
- SHA512 2b0ffbc5b40b935eb57ec4bbff22e6137c602de5bf8ff9a3aeda245f25f2349b38402de49fcdf19547f0ed63d64a656e8db617d3e2dec94868c8988049192a33
- SSDEEP 49152:a+qw+WcbiTL8zYG4CwrX2/oDqQDX7UMfSPTD/9z9Iyj:a+qwAiTL8z22yTX7pfUD/9
- TLSH
  T1FAD5AE13FB828472E9DA017961BB977F4E3E5A109328C9C387A129B59E301D1773F399
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18