2026-07-14_1244337890431b7ef7f69fd5bb45c4f2_cobalt-strike_elex_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-14_1244337890431b7ef7f69fd5bb45c4f2_cobalt-strike_elex_rhadamanthys_stop
Size 247KB
Sample260714-e5sgkaet2m
SHA256 2960588e8c8a73a8cd93786d55d2bff35f750b0351648a55c96e93edb09df9d6
MD5 1244337890431b7ef7f69fd5bb45c4f2
SHA1 aadd21315fdc2b45f04f1ffa75ae9b51330c2ae0
SHA512 b635cc0c1f4faea55961ee0bb0329e691397dd6d38a00b1a16d0d15afc95b0660e931f21d05d9a1c5fd228b0b4a30ca82f98283b84e7e58948b164eab8e9b346
SSDEEP 3072:iQPo3mTk0rp3jQUujlX/82rrxXrrG9rc9rE9ra9rgtrOtrkFEFr2Fw3snPsn7t:iqT/36xXU2ZXuaaQyciap263snPsnR
TLSH
T1DE349EC33B746023EF428E79A1D8D633BE75F6D29EDE04837266C55969843D43B6802E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-14_1244337890431b7ef7f69fd5bb45c4f2_cobalt-strike_elex_rhadamanthys_stop

.exe 247KB

2026-07-14_1244337890431b7ef7f69fd5bb45c4f2_cobalt-strike_elex_rhadamanthys_stop

IMPHASH 44f525f47a13868c625b90ecff10da63
SHA256 2960588e8c8a73a8cd93786d55d2bff35f750b0351648a55c96e93edb09df9d6
MD5 1244337890431b7ef7f69fd5bb45c4f2
SHA1 aadd21315fdc2b45f04f1ffa75ae9b51330c2ae0
SHA512 b635cc0c1f4faea55961ee0bb0329e691397dd6d38a00b1a16d0d15afc95b0660e931f21d05d9a1c5fd228b0b4a30ca82f98283b84e7e58948b164eab8e9b346
SSDEEP 3072:iQPo3mTk0rp3jQUujlX/82rrxXrrG9rc9rE9ra9rgtrOtrkFEFr2Fw3snPsn7t:iqT/36xXU2ZXuaaQyciap263snPsnR
TLSH
T1DE349EC33B746023EF428E79A1D8D633BE75F6D29EDE04837266C55969843D43B6802E
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

a3:f5:f3:ba:3d:f5:7f:20:49:a4:a1:7c:68:7b:c1:49:14:a5:b2:30:11:9a:88:18:0d:27:20:2d:23:a3:9f:42

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=SC331902,CN=SimpleHelp Ltd,O=SimpleHelp Ltd,ST=Midlothian,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130853636f746c616e64,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Jun 27, 2026

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Digest

59:b1:4d:50:93:95:df:c6:e9:06:d4:f2:e0:ce:29:dc:17:a9:4e:5a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

Jun 27, 2026

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

76:53:fe:b9:3d:d9:e7:e9:26:32:ac:d6:0a:be:ac:38

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2020 - Mar 18, 2045

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

4b:2c:3b:01:01:8b:ad:2a:bc:8c:7b:5b:3e:ed:90:57

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 22, 2021 - Mar 21, 2046

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Globalsign R45 TSA for Authenticode 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:b8:30:0d:fb:a8:75:b3:3b:57:cc:26:37:82

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

Serial Number

88:df:10:3c:59:00:2f:69:0f:44:29:d9:10:54:87:8b

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 15, 2024 - Mar 15, 2027

Minor OS version

Major OS version

Entry point

20169

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetVersionExA LocalSize CloseHandle LocalFree CreateThread FreeLibrary GetProcAddress LoadLibraryA HeapAlloc GetProcessHeap DuplicateHandle SetLastError SetEndOfFile HeapSize SetStdHandle WriteConsoleW GetCurrentThreadId GetFileTime GetCurrentDirectoryA CreatePipe LocalAlloc GetLastError GetStdHandle ReadFile TerminateProcess CreateProcessA Sleep FormatMessageA WaitForSingleObject GetCurrentProcess lstrlenA CreateFileA HeapFree ExitProcess InterlockedExchange RaiseException EnterCriticalSection LeaveCriticalSection HeapReAlloc GetModuleHandleA GetCommandLineA UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP TlsGetValue TlsAlloc TlsSetValue TlsFree LCMapStringA WideCharToMultiByte MultiByteToWideChar LCMapStringW DeleteCriticalSection VirtualFree VirtualAlloc HeapDestroy HeapCreate WriteFile GetModuleFileNameA SetHandleCount GetFileType GetStartupInfoA GetConsoleCP GetConsoleMode FlushFileBuffers RtlUnwind InitializeCriticalSection FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetStringTypeA GetStringTypeW GetLocaleInfoA SetFilePointer WriteConsoleA GetConsoleOutputCP

user32

SetProcessWindowStation OpenDesktopA GetThreadDesktop CloseDesktop OpenWindowStationA SetThreadDesktop PostMessageA

advapi32

GetUserNameA OpenSCManagerA SetServiceStatus RegOpenKeyExA RegCreateKeyExA StartServiceA RegDeleteKeyA CreateServiceA RegQueryValueExA RegisterServiceCtrlHandlerA RegSetValueExA ChangeServiceConfig2A DeleteService StartServiceCtrlDispatcherA CloseServiceHandle OpenServiceA ControlService

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-14_1244337890431b7ef7f69fd5bb45c4f2_cobalt-strike_elex_rhadamanthys_stop

kernel32

user32

advapi32

generic