2026-07-29_872412be5ac5e6c0991ed2f51ecee3ce_elex_mafia_rhadamanthys_stealc_tofsee

General

Target
2026-07-29_872412be5ac5e6c0991ed2f51ecee3ce_elex_mafia_rhadamanthys_stealc_tofsee
Size 1.4MB
Sample260729-mxpppssblc
SHA256 58d548fef134f59009c5146481bebdf7b0535f44539a89026c5c2d2f0328b42b
MD5 872412be5ac5e6c0991ed2f51ecee3ce
SHA1 f883d5525702e8b5ea387b7bd688d4971f900075
SHA512 e7ad7d98b9f25455e202d638d7fceba1fa778ede645096a18c5d00fda40906040471021066c7e132478f80b60c532b588f76261affa526425106253dcd0e4763
SSDEEP 24576:EZ1ndfnNYtp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EZh9NYtpLNiXicJFFRGNzj3
TLSH
T1C665F1303584C033C5AB11348ABAC7749A6DFD695B6444C3B3D8AFBE7A346D24F3925A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-29_872412be5ac5e6c0991ed2f51ecee3ce_elex_mafia_rhadamanthys_stealc_tofsee

File Explorer

2026-07-29_872412be5ac5e6c0991ed2f51ecee3ce_elex_mafia_rhadamanthys_stealc_tofsee

.exe 1.4MB

2026-07-29_872412be5ac5e6c0991ed2f51ecee3ce_elex_mafia_rhadamanthys_stealc_tofsee

IMPHASH af5075a440011bc9bc945b0a64ca6343
SHA256 58d548fef134f59009c5146481bebdf7b0535f44539a89026c5c2d2f0328b42b
MD5 872412be5ac5e6c0991ed2f51ecee3ce
SHA1 f883d5525702e8b5ea387b7bd688d4971f900075
SHA512 e7ad7d98b9f25455e202d638d7fceba1fa778ede645096a18c5d00fda40906040471021066c7e132478f80b60c532b588f76261affa526425106253dcd0e4763
SSDEEP 24576:EZ1ndfnNYtp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EZh9NYtpLNiXicJFFRGNzj3
TLSH
T1C665F1303584C033C5AB11348ABAC7749A6DFD695B6444C3B3D8AFBE7A346D24F3925A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

59844

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\HUDSON\workspace\Autoupdate2.1-update\obj\jaureg\Release\jaureg.pdb

kernel32

SetDllDirectoryA CreateDirectoryA GetCommandLineA lstrcmpA LocalFree lstrcmpiA GetLastError WaitForSingleObject CreateProcessA GetExitCodeProcess GlobalAlloc InitializeCriticalSection IsValidLocale GetSystemDirectoryA CloseHandle WriteFile SetFilePointer CreateFileA lstrcatA GetTempPathA CreateMutexA EnumSystemLocalesA GetLocaleInfoA GetSystemTimeAsFileTime HeapFree GetProcAddress GetModuleHandleW ExitProcess DecodePointer EnterCriticalSection LeaveCriticalSection FindClose FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeA FindFirstFileExA HeapAlloc HeapSetInformation GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer WideCharToMultiByte GetTimeZoneInformation Sleep TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement IsProcessorFeaturePresent RaiseException HeapCreate SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection InterlockedExchange LoadLibraryW GetLocaleInfoW GetModuleFileNameW GetConsoleCP GetConsoleMode ReadFile FlushFileBuffers GetFullPathNameA GetFileInformationByHandle PeekNamedPipe GetCurrentDirectoryW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetCPInfo HeapReAlloc GetACP GetOEMCP IsValidCodePage RtlUnwind HeapSize MultiByteToWideChar WriteConsoleW SetStdHandle GetDriveTypeW SetEndOfFile GetProcessHeap LCMapStringW GetStringTypeW CreateFileW CompareStringW SetEnvironmentVariableA GetUserDefaultLCID

user32

wsprintfA

advapi32

RegDeleteValueA RegCloseKey RegEnumKeyA RegQueryInfoKeyA RegOpenKeyExA RegSetValueExA

shell32

SHGetFolderPathA

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-29_872412be5ac5e6c0991ed2f51ecee3ce_elex_mafia_rhadamanthys_stealc_tofsee

kernel32

user32

advapi32

shell32

generic