2026-08-04_51ad7a38cf1789b096894adb45bb065e_elex_rhadamanthys_stealc_stop_tofsee

General

Target
2026-08-04_51ad7a38cf1789b096894adb45bb065e_elex_rhadamanthys_stealc_stop_tofsee
Size 1001KB
Sample260804-s8rlbsterd
SHA256 154e9a3f3766a860a77066d32874c572d8e32e02222004f0c6ffc287eccfe0db
MD5 51ad7a38cf1789b096894adb45bb065e
SHA1 e80e448fa6a93070e1f5c23a3339acc7e2c7b537
SHA512 30d13b27c4b581608a8c1186feb874b91e42460ad80613ca891f9cf31db33d2474c3feb814c3ad67164bd7f0e074e5de65c2fa07d6cfcbdfd82d6c59cc910bd2
SSDEEP 12288:5vG8ghTaFb0WQ/3JlvkbIOEpbhjN+L3E+zRH3WZJ:5xeTCfIBpbhB+LTRH3uJ
TLSH
T1B5251210B18081B3C9B2513A40D5CB799638BC7657AF96D3FBD95EB7AD023D06A362CC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_51ad7a38cf1789b096894adb45bb065e_elex_rhadamanthys_stealc_stop_tofsee

File Explorer

2026-08-04_51ad7a38cf1789b096894adb45bb065e_elex_rhadamanthys_stealc_stop_tofsee

.exe 1001KB

2026-08-04_51ad7a38cf1789b096894adb45bb065e_elex_rhadamanthys_stealc_stop_tofsee

IMPHASH 27829aa329af2b25059a56b7007516bb
SHA256 154e9a3f3766a860a77066d32874c572d8e32e02222004f0c6ffc287eccfe0db
MD5 51ad7a38cf1789b096894adb45bb065e
SHA1 e80e448fa6a93070e1f5c23a3339acc7e2c7b537
SHA512 30d13b27c4b581608a8c1186feb874b91e42460ad80613ca891f9cf31db33d2474c3feb814c3ad67164bd7f0e074e5de65c2fa07d6cfcbdfd82d6c59cc910bd2
SSDEEP 12288:5vG8ghTaFb0WQ/3JlvkbIOEpbhjN+L3E+zRH3WZJ:5xeTCfIBpbhB+LTRH3uJ
TLSH
T1B5251210B18081B3C9B2513A40D5CB799638BC7657AF96D3FBD95EB7AD023D06A362CC
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

66436

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

f:\memtest\MemoryModule08\example\DllLoader\Release\DllLoader.pdb

kernel32

RaiseException GetLastError IsBadReadPtr VirtualProtect GetProcAddress GetModuleHandleA MultiByteToWideChar lstrlenA WideCharToMultiByte lstrlenW GetModuleFileNameW GetModuleFileNameA LoadLibraryA FreeResource SizeofResource LockResource LoadResource FindResourceA Module32Next CloseHandle Module32First CreateToolhelp32Snapshot GetCurrentProcessId CreateFileA CreateFileW GetModuleHandleW VirtualAlloc VirtualFree HeapFree GetProcessHeap FreeLibrary HeapAlloc HeapReAlloc GetCommandLineA DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapCreate Sleep ExitProcess WriteFile GetStdHandle GetConsoleCP GetConsoleMode TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ReadFile HeapSize TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement FlushFileBuffers SetFilePointer SetHandleCount GetFileType GetStartupInfoA RtlUnwind FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle GetCPInfo GetACP GetOEMCP IsValidCodePage CompareStringA CompareStringW SetEnvironmentVariableA GetLocaleInfoA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW SetEndOfFile

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_51ad7a38cf1789b096894adb45bb065e_elex_rhadamanthys_stealc_stop_tofsee

kernel32

generic