2026-07-29_d7c912a2356f6006ed45b7d6e528afb4_elex_hijackloader_karagany_mafia_rhadamanthys

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-29_d7c912a2356f6006ed45b7d6e528afb4_elex_hijackloader_karagany_mafia_rhadamanthys
Size 134KB
Sample260729-13zzhstdme
SHA256 892cb8c2ee4f9275cdc3d78553e7464233355fa1f1d8646a390b3107e523c73f
MD5 d7c912a2356f6006ed45b7d6e528afb4
SHA1 224e7b8b1c6638ed27fce70a9736e2cf2e82cb24
SHA512 7268595c3459ce01ffd35bbf519d35452a1fb24a5bc0fe62073bf6ce99af52b6cf3dd2d9ea0eb35bf39506f942d5294fc338693ec94da03531409236756eb2ad
SSDEEP 3072:g2bN0d/Ny5X4uw1NJcmiigzPQtFBkxppJJo2hx9NcisN8Hba:PbyDUXg1kCELncisNSu
TLSH
T1B2D37D1132E4C039E11325798D94C7B24A7BB8766561E88F7FC60AB59F28790EB1933F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-07-29_d7c912a2356f6006ed45b7d6e528afb4_elex_hijackloader_karagany_mafia_rhadamanthys

File Explorer

2026-07-29_d7c912a2356f6006ed45b7d6e528afb4_elex_hijackloader_karagany_mafia_rhadamanthys

.exe 134KB

2026-07-29_d7c912a2356f6006ed45b7d6e528afb4_elex_hijackloader_karagany_mafia_rhadamanthys

IMPHASH 21825a9e169b34426baf296b1f3fef3b
SHA256 892cb8c2ee4f9275cdc3d78553e7464233355fa1f1d8646a390b3107e523c73f
MD5 d7c912a2356f6006ed45b7d6e528afb4
SHA1 224e7b8b1c6638ed27fce70a9736e2cf2e82cb24
SHA512 7268595c3459ce01ffd35bbf519d35452a1fb24a5bc0fe62073bf6ce99af52b6cf3dd2d9ea0eb35bf39506f942d5294fc338693ec94da03531409236756eb2ad
SSDEEP 3072:g2bN0d/Ny5X4uw1NJcmiigzPQtFBkxppJJo2hx9NcisN8Hba:PbyDUXg1kCELncisNSu
TLSH
T1B2D37D1132E4C039E11325798D94C7B24A7BB8766561E88F7FC60AB59F28790EB1933F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

af:00:2a:f0:24:c0:74:2c:a5:7d:23:48:03:77:bf:68:3b:b2:33:98:fa:e8:43:6d:c4:4d:e8:16:11:9d:75:e9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=0128-01-006673,CN=Yokogawa Test & Measurement Corporation,O=Yokogawa Test & Measurement Corporation,L=Hachioji-shi,ST=Tokyo,C=JP,2.5.4.15=#131450726976617465206f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024a50

Chains

Jan 1, 0001

Subject

CN=DigiCert Global G3 Code Signing ECC SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0f:b8:a7:40:b9:15:8d:03:51:43:bc:59:d9:f0:40:29

Issuer

CN=DigiCert Global Root G3,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

May 15, 2026

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0b:43:43:16:3e:90:90:f7:8a:85:48:b8:b8:65:2a:6b

Issuer

CN=DigiCert Global G3 Code Signing ECC SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 19, 2023 - Oct 28, 2024

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Minor OS version

Major OS version

Entry point

7231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

\\mtdsoft\SoftWare\KEW統合アプリケーション\KEW6315OEM\CW500SetupLauncher\Debug\KEWSetupLauncher2.pdb

version

GetFileVersionInfoW GetFileVersionInfoSizeW

kernel32

GetCurrentDirectoryW SetCurrentDirectoryW FindFirstFileW FindClose CreateProcessW CloseHandle WaitForSingleObject GetLocaleInfoW CreateFileW WideCharToMultiByte WriteFile FlushFileBuffers GetUserDefaultLCID GetStringTypeW GetLocaleInfoA EnumSystemLocalesA GetExitCodeProcess InitializeCriticalSectionAndSpinCount GetCommandLineW HeapSetInformation GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer DecodePointer HeapAlloc RaiseException GetLastError HeapFree GetProcAddress GetModuleHandleW ExitProcess GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount IsValidLocale GetFileType DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCurrentThread HeapCreate HeapDestroy QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime IsProcessorFeaturePresent Sleep HeapSize LeaveCriticalSection FatalAppExitA EnterCriticalSection SetFilePointer GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage SetConsoleCtrlHandler FreeLibrary InterlockedExchange LoadLibraryW RtlUnwind HeapReAlloc SetStdHandle WriteConsoleW MultiByteToWideChar LCMapStringW

user32

wsprintfW

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-29_d7c912a2356f6006ed45b7d6e528afb4_elex_hijackloader_karagany_mafia_rhadamanthys

PE Signature issue

version

kernel32

user32

advapi32

generic