General
- Target 2026-08-04_5f22e292965935c50da8c9486237cfdd_elex_lockbit_rhadamanthys_stealc_stop
- Size 167KB
- Sample260804-hxzgpaeh87
- SHA256 eec6e4d069d0ef62235c0b20b2bc9faec94691049b41b5961d3bccd943a141f2
- MD5 5f22e292965935c50da8c9486237cfdd
- SHA1 fb7e62856a16092fd27970ac0537d4267656ed70
- SHA512 e7d89b4b228878de590fb64ebe50818c8c47808c3d5d3ecf73f8e5880ad35087176b7c06d62e9493acce65e550607cf5a8666123c4123fdd9a6e393895b36928
- SSDEEP 3072:o9K3Y2oTgnZsG1Q1RieB7gIB4HKm/lgYs+4ylDe:SK7PnKd1RiehgIBo1nq
- TLSH T176F38D21BECC8072C0B61270157ED625AA7EBA323735958777705AADCF60BE0A637347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-04_5f22e292965935c50da8c9486237cfdd_elex_lockbit_rhadamanthys_stealc_stop.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_5f22e292965935c50da8c9486237cfdd_elex_lockbit_rhadamanthys_stealc_stop.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-04_5f22e292965935c50da8c9486237cfdd_elex_lockbit_rhadamanthys_stealc_stop
- Size 167KB
- SHA256 eec6e4d069d0ef62235c0b20b2bc9faec94691049b41b5961d3bccd943a141f2
- MD5 5f22e292965935c50da8c9486237cfdd
- SHA1 fb7e62856a16092fd27970ac0537d4267656ed70
- SHA512 e7d89b4b228878de590fb64ebe50818c8c47808c3d5d3ecf73f8e5880ad35087176b7c06d62e9493acce65e550607cf5a8666123c4123fdd9a6e393895b36928
- SSDEEP 3072:o9K3Y2oTgnZsG1Q1RieB7gIB4HKm/lgYs+4ylDe:SK7PnKd1RiehgIBo1nq
- TLSH T176F38D21BECC8072C0B61270157ED625AA7EBA323735958777705AADCF60BE0A637347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects LgoogLoader payload
-
Family: LgoogLoader
A downloader capable of dropping and executing other malware families.
-
Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
-
Detects executables Discord URL observed in first stage droppers
-
Deletes itself
-
Executes dropped EXE
-
Suspicious use of SetThreadContext