2026-07-30_9417e962e4197799f8f188877df7dd1c_elex_rhadamanthys_stop

General

Target
2026-07-30_9417e962e4197799f8f188877df7dd1c_elex_rhadamanthys_stop
Size 1.3MB
Sample260730-krge2afp4x
SHA256 73434426afb21a6bd76bc08ae822c534c55e781283e1f9568ffc7d762d05ae69
MD5 9417e962e4197799f8f188877df7dd1c
SHA1 bc2a68acd81419734023d0884ec77a0776e0db3e
SHA512 23e64bb61e1aaeebfc9a2a947cc5097cfd3c76a3bfb72cf51477e2bb9464bc2875837f4ea7f4375a668c1280912a274d5eaaea28571b329e4bbccca3709bf4a2
SSDEEP 12288:0qGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:XnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T19C5512293902D436F7160B704841D1C15BBE0CBB3AE5E25FFB68393958762DB06B729E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_9417e962e4197799f8f188877df7dd1c_elex_rhadamanthys_stop

File Explorer

2026-07-30_9417e962e4197799f8f188877df7dd1c_elex_rhadamanthys_stop

.exe 1.3MB

2026-07-30_9417e962e4197799f8f188877df7dd1c_elex_rhadamanthys_stop

IMPHASH d041fd3427f0210a34aa6d3bafec5056
SHA256 73434426afb21a6bd76bc08ae822c534c55e781283e1f9568ffc7d762d05ae69
MD5 9417e962e4197799f8f188877df7dd1c
SHA1 bc2a68acd81419734023d0884ec77a0776e0db3e
SHA512 23e64bb61e1aaeebfc9a2a947cc5097cfd3c76a3bfb72cf51477e2bb9464bc2875837f4ea7f4375a668c1280912a274d5eaaea28571b329e4bbccca3709bf4a2
SSDEEP 12288:0qGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:XnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T19C5512293902D436F7160B704841D1C15BBE0CBB3AE5E25FFB68393958762DB06B729E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7073

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\Recent\ATKRelation\ATK Hotkey\InstAsRgbKbSrv\release\InstAsRgbKbSrv.pdb

kernel32

OutputDebugStringW GetLastError Sleep GetModuleFileNameW GetCurrentProcess GetModuleHandleW GetProcAddress GlobalFree GetCommandLineW FlushFileBuffers CloseHandle HeapFree GetVersionExA HeapAlloc GetProcessHeap GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA MultiByteToWideChar GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringA WideCharToMultiByte LCMapStringW GetStringTypeA GetStringTypeW LeaveCriticalSection EnterCriticalSection GetLocaleInfoA SetFilePointer GetConsoleCP GetConsoleMode LoadLibraryA InitializeCriticalSection VirtualAlloc HeapReAlloc RtlUnwind SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW HeapSize CreateFileA

advapi32

OpenSCManagerW RegCloseKey RegOpenKeyExW DeleteService ControlService OpenServiceW CloseServiceHandle QueryServiceStatusEx StartServiceW CreateServiceW

shell32

CommandLineToArgvW

shlwapi

SHDeleteKeyW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_9417e962e4197799f8f188877df7dd1c_elex_rhadamanthys_stop

kernel32

advapi32

shell32

shlwapi

generic