2026-06-30_7be6298096cbeba939212871877a7bda_elex_karagany_rhadamanthys_stop

General

Target
2026-06-30_7be6298096cbeba939212871877a7bda_elex_karagany_rhadamanthys_stop
Size 5.7MB
Sample260701-es7eysd16k
SHA256 c76ac259e00dd2792d23ecdcb968d34c0a8dd398329b04b4dc17a22194a7ab7e
MD5 7be6298096cbeba939212871877a7bda
SHA1 09c435768cbd9c0c9e24c3d83d1a3bb0c17ec2c1
SHA512 ad137082a4d4f335a4fec4d896ed57a6b3fc9964aa35b11e63c43b06872ddf68aaf6e61b0de5ee8dac9dff823ee94fda2ed3f684fb8515faf64e5adcf2759300
SSDEEP 98304:Wtj7Zm98WL2zlbqSNzkSwFCSXMcKGXXxItI/ITPAJhLhHGTsPrCyc9i6Mlg2fGFv:Wtj7pXbHqJXsOE4XhOUkinlgUGrV
TLSH
T13A563340FAD010F0C5EB6C314DF999921675AE8AC8D5F98339E0BB017C71D919B39AAF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-30_7be6298096cbeba939212871877a7bda_elex_karagany_rhadamanthys_stop

File Explorer

2026-06-30_7be6298096cbeba939212871877a7bda_elex_karagany_rhadamanthys_stop

.exe 5.7MB

2026-06-30_7be6298096cbeba939212871877a7bda_elex_karagany_rhadamanthys_stop

IMPHASH 9b0974e10a21ff44f065d582c0872e7e
SHA256 c76ac259e00dd2792d23ecdcb968d34c0a8dd398329b04b4dc17a22194a7ab7e
MD5 7be6298096cbeba939212871877a7bda
SHA1 09c435768cbd9c0c9e24c3d83d1a3bb0c17ec2c1
SHA512 ad137082a4d4f335a4fec4d896ed57a6b3fc9964aa35b11e63c43b06872ddf68aaf6e61b0de5ee8dac9dff823ee94fda2ed3f684fb8515faf64e5adcf2759300
SSDEEP 98304:Wtj7Zm98WL2zlbqSNzkSwFCSXMcKGXXxItI/ITPAJhLhHGTsPrCyc9i6Mlg2fGFv:Wtj7pXbHqJXsOE4XhOUkinlgUGrV
TLSH
T13A563340FAD010F0C5EB6C314DF999921675AE8AC8D5F98339E0BB017C71D919B39AAF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

11641

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InitializeCriticalSectionAndSpinCount LockResource GetProcAddress VirtualAlloc GetLastError LoadResource SizeofResource GetFileSize WriteFile ReadFile CloseHandle LoadLibraryA GetModuleFileNameW GetModuleHandleW CreateProcessW GetEnvironmentVariableW SetEnvironmentVariableW FindResourceW FindResourceExW GetTempPathW GetTempFileNameW CreateFileW DeleteFileW MultiByteToWideChar WideCharToMultiByte GetCommandLineW HeapFree GetSystemTimeAsFileTime RaiseException RtlUnwind SetLastError InterlockedIncrement InterlockedDecrement GetCurrentThreadId EncodePointer DecodePointer ExitProcess GetModuleHandleExW GetStdHandle GetProcessHeap GetFileType DeleteCriticalSection GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree IsProcessorFeaturePresent IsDebuggerPresent HeapAlloc HeapReAlloc HeapSize EnterCriticalSection LeaveCriticalSection Sleep IsValidCodePage GetACP GetOEMCP GetCPInfo LoadLibraryExW OutputDebugStringW LoadLibraryW GetStringTypeW LCMapStringW FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx SetStdHandle WriteConsoleW HeapDestroy

shell32

ShellExecuteW

shlwapi

PathRenameExtensionW PathFileExistsW

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-30_7be6298096cbeba939212871877a7bda_elex_karagany_rhadamanthys_stop

kernel32

shell32

shlwapi

generic