2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc
Size 1.5MB
Sample260729-nd3mwssfla
SHA256 6d2e1b237ff51ec826dd1b3334aa00000fa4e98379aefc65e87a8c3015d9a1a9
MD5 20caa46c8cdb22429bafe93c42649002
SHA1 d09625e762ceb3f32f535342aa4b4fcf2a1b3114
SHA512 26663c889d26a9d85cd0b7163df60a058352db8abba20ea143f51651014b80c9b84f6bff8a77d3f55a18295fa4635f343df954f9c13ef9e1947c542a5b19d62e
SSDEEP 24576:h1Q9VABbGz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nQ4xGzLNiXicJFFRGNzj3
TLSH
T1CD65F1313644C033D5A711388ABAC7799A6DFD66576140C3A3D8AFBD7E346C28F3825A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc

File Explorer

2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc

.exe 1.5MB

2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc

IMPHASH b332e4d23eab6978e0dbb763997b24f0
SHA256 6d2e1b237ff51ec826dd1b3334aa00000fa4e98379aefc65e87a8c3015d9a1a9
MD5 20caa46c8cdb22429bafe93c42649002
SHA1 d09625e762ceb3f32f535342aa4b4fcf2a1b3114
SHA512 26663c889d26a9d85cd0b7163df60a058352db8abba20ea143f51651014b80c9b84f6bff8a77d3f55a18295fa4635f343df954f9c13ef9e1947c542a5b19d62e
SSDEEP 24576:h1Q9VABbGz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nQ4xGzLNiXicJFFRGNzj3
TLSH
T1CD65F1313644C033D5A711388ABAC7799A6DFD66576140C3A3D8AFBD7E346C28F3825A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

69663

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\HUDSON\workspace\Autoupdate2.1-update\obj\jaucheck\Release\jaucheck.pdb

shlwapi

PathIsURLA

wininet

InternetCloseHandle

urlmon

URLDownloadToFileA

crypt32

CryptMsgGetParam CertFindCertificateInStore CertGetNameStringW CertCloseStore CryptMsgClose CryptQueryObject

kernel32

CreateFileA SetFilePointer WriteFile lstrlenA CloseHandle GetTempPathA GetLastError SetDllDirectoryA MultiByteToWideChar CreateMutexA CreateProcessA WideCharToMultiByte lstrlenW ReadFile Sleep lstrcmpA SetStdHandle WriteConsoleW LCMapStringW GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetDriveTypeW SetEndOfFile GetProcessHeap CreateFileW CompareStringW SetEnvironmentVariableA InitializeCriticalSection FindClose RtlUnwind GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA GetSystemTimeAsFileTime HeapFree EncodePointer DecodePointer GetProcAddress GetModuleHandleW ExitProcess EnterCriticalSection LeaveCriticalSection HeapAlloc FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeA FindFirstFileExA GetCommandLineA HeapSetInformation TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetTimeZoneInformation TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapCreate IsProcessorFeaturePresent RaiseException HeapSize HeapReAlloc SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW DeleteCriticalSection InterlockedExchange LoadLibraryW GetLocaleInfoW GetModuleFileNameW GetConsoleCP GetConsoleMode FlushFileBuffers GetCPInfo GetACP GetOEMCP IsValidCodePage GetFullPathNameA GetFileInformationByHandle PeekNamedPipe GetCurrentDirectoryW

user32

wsprintfA

advapi32

CryptGetHashParam CryptHashData CryptReleaseContext CryptCreateHash CryptAcquireContextA RegSetValueExA RegDeleteValueA RegQueryValueExA RegDeleteKeyA RegCreateKeyExA RegCloseKey RegOpenKeyExA CryptDestroyHash

shell32

SHGetFolderPathA

ole32

CoCreateInstance CoInitialize CoUninitialize CLSIDFromString

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc

shlwapi

wininet

urlmon

crypt32

kernel32

user32

advapi32

shell32

ole32

generic