2026-07-08_50ba95b744806a727cabb66d4700610c_elex_karagany_rhadamanthys_stop

General

Target
2026-07-08_50ba95b744806a727cabb66d4700610c_elex_karagany_rhadamanthys_stop
Size 5.7MB
Sample260708-2edbaaaz5v
SHA256 d49d1f7a855aed93206b39f432b800856dcf98eeec7b7a6a8d0be74654595fc5
MD5 50ba95b744806a727cabb66d4700610c
SHA1 1f9ccd9e49911a2f6256a6a2363088fdb18fa0ad
SHA512 4ba52c0b7ee28a8e654285e28b1f2ad59c81d42faf8ec994cf21a4c16ca6c9755c182f9f428682ffdafd71a5567b803f15f47022f409467bf008f4e25969c4a7
SSDEEP 98304:aW9mEPZm98WL2zlbqSNzkSwFCSXMcKGXXxItI/ITPAJhLhHGTsPrCyc9i6Mlg2fC:akPpXbHqJXsOE4XhOUkinlgUGrV
TLSH
T140563300FAD020F0C5FB5C314CF9599206B97E4A88D6F9873AE4BB017C75D919B29A6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-08_50ba95b744806a727cabb66d4700610c_elex_karagany_rhadamanthys_stop

File Explorer

2026-07-08_50ba95b744806a727cabb66d4700610c_elex_karagany_rhadamanthys_stop

.exe 5.7MB

2026-07-08_50ba95b744806a727cabb66d4700610c_elex_karagany_rhadamanthys_stop

IMPHASH 9b0974e10a21ff44f065d582c0872e7e
SHA256 d49d1f7a855aed93206b39f432b800856dcf98eeec7b7a6a8d0be74654595fc5
MD5 50ba95b744806a727cabb66d4700610c
SHA1 1f9ccd9e49911a2f6256a6a2363088fdb18fa0ad
SHA512 4ba52c0b7ee28a8e654285e28b1f2ad59c81d42faf8ec994cf21a4c16ca6c9755c182f9f428682ffdafd71a5567b803f15f47022f409467bf008f4e25969c4a7
SSDEEP 98304:aW9mEPZm98WL2zlbqSNzkSwFCSXMcKGXXxItI/ITPAJhLhHGTsPrCyc9i6Mlg2fC:akPpXbHqJXsOE4XhOUkinlgUGrV
TLSH
T140563300FAD020F0C5FB5C314CF9599206B97E4A88D6F9873AE4BB017C75D919B29A6F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

11641

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InitializeCriticalSectionAndSpinCount LockResource GetProcAddress VirtualAlloc GetLastError LoadResource SizeofResource GetFileSize WriteFile ReadFile CloseHandle LoadLibraryA GetModuleFileNameW GetModuleHandleW CreateProcessW GetEnvironmentVariableW SetEnvironmentVariableW FindResourceW FindResourceExW GetTempPathW GetTempFileNameW CreateFileW DeleteFileW MultiByteToWideChar WideCharToMultiByte GetCommandLineW HeapFree GetSystemTimeAsFileTime RaiseException RtlUnwind SetLastError InterlockedIncrement InterlockedDecrement GetCurrentThreadId EncodePointer DecodePointer ExitProcess GetModuleHandleExW GetStdHandle GetProcessHeap GetFileType DeleteCriticalSection GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree IsProcessorFeaturePresent IsDebuggerPresent HeapAlloc HeapReAlloc HeapSize EnterCriticalSection LeaveCriticalSection Sleep IsValidCodePage GetACP GetOEMCP GetCPInfo LoadLibraryExW OutputDebugStringW LoadLibraryW GetStringTypeW LCMapStringW FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx SetStdHandle WriteConsoleW HeapDestroy

shell32

ShellExecuteW

shlwapi

PathRenameExtensionW PathFileExistsW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-08_50ba95b744806a727cabb66d4700610c_elex_karagany_rhadamanthys_stop

kernel32

shell32

shlwapi

generic