2026-07-14_530e027e2eca28aa98e55339b38b758a_elex_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-14_530e027e2eca28aa98e55339b38b758a_elex_rhadamanthys_stop
Size 153KB
Sample260714-eh8v2af16w
SHA256 675df784b67e421e7c08529237f205c91f4211e6debba03b5d7eda468f8c6492
MD5 530e027e2eca28aa98e55339b38b758a
SHA1 6565f2866ccbe17977df369dd3395b934d365d5f
SHA512 4cc272c1ec9496ea12cc61b6814391966c4fb18d64f57ec1390352e79530576cfac1063fafeea8ec595b3b218f5e9c9fd67e6871a5e9c7e4a2db878a71488187
SSDEEP 3072:wJLIufC/DbsMNKDTt/CFlFmFWF/ksnEsnRt:wJLW/DbsEbokRksnEsnRt
TLSH
T1ACE3AE863D32A033F6824D74A1D8C5A3AFBFB9837DBA0817B759424D4B853D4376826D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-14_530e027e2eca28aa98e55339b38b758a_elex_rhadamanthys_stop

.exe 153KB

2026-07-14_530e027e2eca28aa98e55339b38b758a_elex_rhadamanthys_stop

IMPHASH 757492c5713605bc46a20f88c2b4ba5e
SHA256 675df784b67e421e7c08529237f205c91f4211e6debba03b5d7eda468f8c6492
MD5 530e027e2eca28aa98e55339b38b758a
SHA1 6565f2866ccbe17977df369dd3395b934d365d5f
SHA512 4cc272c1ec9496ea12cc61b6814391966c4fb18d64f57ec1390352e79530576cfac1063fafeea8ec595b3b218f5e9c9fd67e6871a5e9c7e4a2db878a71488187
SSDEEP 3072:wJLIufC/DbsMNKDTt/CFlFmFWF/ksnEsnRt:wJLW/DbsEbokRksnEsnRt
TLSH
T1ACE3AE863D32A033F6824D74A1D8C5A3AFBFB9837DBA0817B759424D4B853D4376826D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

f1:f8:d4:23:52:be:8b:b4:08:ac:43:9d:9c:44:5f:5b:9c:49:6c:32:11:ef:e8:14:dd:38:91:e7:29:70:de:91

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=SC331902,CN=SimpleHelp Ltd,O=SimpleHelp Ltd,ST=Midlothian,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130853636f746c616e64,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Jun 27, 2026

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Digest

b4:06:48:9c:27:db:3b:f3:01:8b:e2:80:c7:3f:2a:b3:1a:bf:53:39

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

Jun 27, 2026

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

76:53:fe:b9:3d:d9:e7:e9:26:32:ac:d6:0a:be:ac:38

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2020 - Mar 18, 2045

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

4b:2c:3b:01:01:8b:ad:2a:bc:8c:7b:5b:3e:ed:90:57

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 22, 2021 - Mar 21, 2046

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Globalsign R45 TSA for Authenticode 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:b8:30:0d:fb:a8:75:b3:3b:57:cc:26:37:82

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

Serial Number

88:df:10:3c:59:00:2f:69:0f:44:29:d9:10:54:87:8b

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 15, 2024 - Mar 15, 2027

Minor OS version

Major OS version

Entry point

15956

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Sleep GetVersionExW GetExitCodeProcess ReadFile CreateFileW FlushFileBuffers GetStdHandle GetLastError SetLastError GetProcAddress LoadLibraryW Process32FirstW ProcessIdToSessionId CreatePipe Process32NextW lstrcatW CreateToolhelp32Snapshot CloseHandle GetCurrentProcessId ResumeThread CreateThread GetSystemDirectoryW OpenProcess WriteFile WaitNamedPipeW WaitForSingleObject SetHandleInformation CreateProcessW GetLocalTime FreeLibrary SetEndOfFile HeapAlloc EnterCriticalSection LeaveCriticalSection GetModuleHandleA ExitProcess HeapFree GetVersionExA GetProcessHeap TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId DeleteCriticalSection VirtualFree VirtualAlloc HeapReAlloc HeapDestroy HeapCreate GetModuleFileNameA SetHandleCount GetFileType GetStartupInfoA WideCharToMultiByte GetConsoleCP GetConsoleMode RtlUnwind LoadLibraryA InitializeCriticalSection GetModuleFileNameW FreeEnvironmentStringsA MultiByteToWideChar GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetFilePointer WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA HeapSize

advapi32

DuplicateTokenEx LookupAccountSidW LookupPrivilegeValueW SetTokenInformation CreateProcessAsUserW GetTokenInformation OpenProcessToken AdjustTokenPrivileges

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-14_530e027e2eca28aa98e55339b38b758a_elex_rhadamanthys_stop

kernel32

advapi32

wtsapi32

userenv

generic