2026-08-01_a994995ee774630224d49de9c95ff447_elex_rhadamanthys_stealc_stop_tofsee

General

Target
2026-08-01_a994995ee774630224d49de9c95ff447_elex_rhadamanthys_stealc_stop_tofsee
Size 1.1MB
Sample260801-dbah8awdkd
SHA256 676144df40617699edb173c6e3cb0eadff0ad6e9cff43bba47970280deb151a6
MD5 a994995ee774630224d49de9c95ff447
SHA1 616851ef78904172b058720c0d2b3b38cdbe0533
SHA512 ef86224d992edcf3aead2a3b65f690739a84d7aded863ae55cea79073caec887d279c55d93fd2decc2b70867a08aaf2bc436e9f0f6a6508c6b03c9acb5f4d48f
SSDEEP 24576:5xeTCaTSu5efmqVgKY4DzHH3FepvV+aDSOG+ghYX5kg60:LeT/TSu5XqGHShY9DVgWX5kg6
TLSH
T1A03512007680C633C03A533526D247B65A7A72616F66EAD3F7993B729E12AE05F343CD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_a994995ee774630224d49de9c95ff447_elex_rhadamanthys_stealc_stop_tofsee

File Explorer

2026-08-01_a994995ee774630224d49de9c95ff447_elex_rhadamanthys_stealc_stop_tofsee

.exe 1.1MB

2026-08-01_a994995ee774630224d49de9c95ff447_elex_rhadamanthys_stealc_stop_tofsee

IMPHASH 27829aa329af2b25059a56b7007516bb
SHA256 676144df40617699edb173c6e3cb0eadff0ad6e9cff43bba47970280deb151a6
MD5 a994995ee774630224d49de9c95ff447
SHA1 616851ef78904172b058720c0d2b3b38cdbe0533
SHA512 ef86224d992edcf3aead2a3b65f690739a84d7aded863ae55cea79073caec887d279c55d93fd2decc2b70867a08aaf2bc436e9f0f6a6508c6b03c9acb5f4d48f
SSDEEP 24576:5xeTCaTSu5efmqVgKY4DzHH3FepvV+aDSOG+ghYX5kg60:LeT/TSu5XqGHShY9DVgWX5kg6
TLSH
T1A03512007680C633C03A533526D247B65A7A72616F66EAD3F7993B729E12AE05F343CD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

66436

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

f:\memtest\MemoryModule08\example\DllLoader\Release\DllLoader.pdb

kernel32

RaiseException GetLastError IsBadReadPtr VirtualProtect GetProcAddress GetModuleHandleA MultiByteToWideChar lstrlenA WideCharToMultiByte lstrlenW GetModuleFileNameW GetModuleFileNameA LoadLibraryA FreeResource SizeofResource LockResource LoadResource FindResourceA Module32Next CloseHandle Module32First CreateToolhelp32Snapshot GetCurrentProcessId CreateFileA CreateFileW GetModuleHandleW VirtualAlloc VirtualFree HeapFree GetProcessHeap FreeLibrary HeapAlloc HeapReAlloc GetCommandLineA DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapCreate Sleep ExitProcess WriteFile GetStdHandle GetConsoleCP GetConsoleMode TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ReadFile HeapSize TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement FlushFileBuffers SetFilePointer SetHandleCount GetFileType GetStartupInfoA RtlUnwind FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle GetCPInfo GetACP GetOEMCP IsValidCodePage CompareStringA CompareStringW SetEnvironmentVariableA GetLocaleInfoA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW SetEndOfFile

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_a994995ee774630224d49de9c95ff447_elex_rhadamanthys_stealc_stop_tofsee

kernel32

generic