2026-08-03_bdaa3bdedfbe5adfee15f561f3d4d1fd_elex_karagany_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_bdaa3bdedfbe5adfee15f561f3d4d1fd_elex_karagany_rhadamanthys_stop
Size 118KB
Sample260804-ly97csxcmh
SHA256 a59f415b7edd23d6007a4e66fd82c20ca9a89310286cf1e12e53b0257d72cea0
MD5 bdaa3bdedfbe5adfee15f561f3d4d1fd
SHA1 81c1ad729d0f2f619771d33cdcdaa052686d3060
SHA512 2b865b3f5e5492d44688a646d8061d53ff22fc9a322404eff9d05d8b3e03af0986dc5a11fb1c78721b2a51f1593efbccce776af5b4688af6ad79edcf86279c7f
SSDEEP 3072:Fksm2Y0sP/jsZ2guNINl0zfqICHltnQiVuTqetl5I+/9R:tXY0sP/jsg0HltQi4TTr5z/9R
TLSH
T118C39E3131D0C036D5A228318C75CAA29D7EB8B25B38D4CBBB98157D5E913D0DBB936B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-08-03_bdaa3bdedfbe5adfee15f561f3d4d1fd_elex_karagany_rhadamanthys_stop

File Explorer

2026-08-03_bdaa3bdedfbe5adfee15f561f3d4d1fd_elex_karagany_rhadamanthys_stop

.exe 118KB

2026-08-03_bdaa3bdedfbe5adfee15f561f3d4d1fd_elex_karagany_rhadamanthys_stop

IMPHASH 6625f77986a8aecd5ea558a7ad166299
SHA256 a59f415b7edd23d6007a4e66fd82c20ca9a89310286cf1e12e53b0257d72cea0
MD5 bdaa3bdedfbe5adfee15f561f3d4d1fd
SHA1 81c1ad729d0f2f619771d33cdcdaa052686d3060
SHA512 2b865b3f5e5492d44688a646d8061d53ff22fc9a322404eff9d05d8b3e03af0986dc5a11fb1c78721b2a51f1593efbccce776af5b4688af6ad79edcf86279c7f
SSDEEP 3072:Fksm2Y0sP/jsZ2guNINl0zfqICHltnQiVuTqetl5I+/9R:tXY0sP/jsg0HltQi4TTr5z/9R
TLSH
T118C39E3131D0C036D5A228318C75CAA29D7EB8B25B38D4CBBB98157D5E913D0DBB936B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

3b:fb:ff:ea:3f:22:e5:1a:7b:e0:02:9a:50:1d:4d:87:c5:a7:bf:26

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=JP Software,O=JP Software,POSTALCODE=21678,STREET=12501 Coopers Lane,L=Worton,ST=MD,C=US

Chains

Aug 14, 2012

CN=JP Software,O=JP Software,POSTALCODE=21678,STREET=12501 Coopers Lane,L=Worton,ST=MD,C=US

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=JP Software,O=JP Software,POSTALCODE=21678,STREET=12501 Coopers Lane,L=Worton,ST=MD,C=US

Serial Number

c8:b5:32:d1:3d:15:86:d9:71:1d:32:a1:a2:7b:3c:95

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 8, 2011 - Sep 7, 2012

Minor OS version

Major OS version

Entry point

25370

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\TakeCommand14\tcc\Release\TPipe.pdb

kernel32

SetUnhandledExceptionFilter HeapReAlloc ExitProcess GetCommandLineW GetTempFileNameW InterlockedDecrement GetCurrentProcess WriteFile GetConsoleCP WideCharToMultiByte Sleep FormatMessageW GetFileAttributesW TerminateProcess ReadFile CreateFileW MultiByteToWideChar lstrlenW GetTempPathW GetStdHandle GetLastError GetFileType SetConsoleCtrlHandler lstrcmpiW lstrcatW GetCurrentThreadId CloseHandle lstrcpyW SetEnvironmentVariableW CompareStringW SetStdHandle WriteConsoleW SetFilePointer CreateProcessW WaitForSingleObject GetExitCodeProcess FlushFileBuffers GetConsoleMode LoadLibraryW LCMapStringW GetStringTypeW RtlUnwind LocalFree EnterCriticalSection LeaveCriticalSection EncodePointer DecodePointer DeleteFileW HeapSetInformation RaiseException UnhandledExceptionFilter GetSystemTimeAsFileTime IsDebuggerPresent IsProcessorFeaturePresent GetCPInfo InterlockedIncrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SetLastError GetProcAddress SetHandleCount InitializeCriticalSectionAndSpinCount GetStartupInfoW DeleteCriticalSection HeapFree HeapSize HeapAlloc GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId

user32

CharUpperW

ole32

CoInitialize OleRun CoCreateInstance

oleaut32

SysFreeString VariantChangeType VariantInit VariantClear SysStringLen SysAllocString GetErrorInfo

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_bdaa3bdedfbe5adfee15f561f3d4d1fd_elex_karagany_rhadamanthys_stop

PE Signature issue

kernel32

user32

ole32

oleaut32

generic