2026-08-07_4bc0e5f4195a1cd0307501c1da364443_elex_rhadamanthys_stop

General

Target
2026-08-07_4bc0e5f4195a1cd0307501c1da364443_elex_rhadamanthys_stop
Size 1.3MB
Sample260807-ynr91ssfla
SHA256 c9205a3c99241c225084137cfb5600255c3af6ef7f1e89ab2e672a964cfce275
MD5 4bc0e5f4195a1cd0307501c1da364443
SHA1 de575ea94c7493dd1bd8bcde0135753dec6a5313
SHA512 0a5edfc1aca853b1d089bc8c73acc87f4a29bdc3d3ab0f853663a01d0fb93c5fa77af17fde8392575423b6c55f1823c61679a7703cab22b12e9ccc8e12273947
SSDEEP 12288:AeIms0AqIyDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:AnwVdZjHhQ6giafmvJW5
TLSH
T1B455F10171828274E30683344416E6B5437DECB41ED4D64FF6A83F76AEBA59B2BA710F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-07_4bc0e5f4195a1cd0307501c1da364443_elex_rhadamanthys_stop

File Explorer

2026-08-07_4bc0e5f4195a1cd0307501c1da364443_elex_rhadamanthys_stop

.exe 1.3MB

2026-08-07_4bc0e5f4195a1cd0307501c1da364443_elex_rhadamanthys_stop

IMPHASH 3b570ec4c30b9fe6d6f6b5052191c92b
SHA256 c9205a3c99241c225084137cfb5600255c3af6ef7f1e89ab2e672a964cfce275
MD5 4bc0e5f4195a1cd0307501c1da364443
SHA1 de575ea94c7493dd1bd8bcde0135753dec6a5313
SHA512 0a5edfc1aca853b1d089bc8c73acc87f4a29bdc3d3ab0f853663a01d0fb93c5fa77af17fde8392575423b6c55f1823c61679a7703cab22b12e9ccc8e12273947
SSDEEP 12288:AeIms0AqIyDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:AnwVdZjHhQ6giafmvJW5
TLSH
T1B455F10171828274E30683344416E6B5437DECB41ED4D64FF6A83F76AEBA59B2BA710F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

26858

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Documents and Settings\Administrator\My Documents\Visual Studio 2008\Projects\SmadavHelper1416\Release\SmadavHelper.pdb

kernel32

DeleteFileW FileTimeToSystemTime GetFileInformationByHandle GetFileSize UnmapViewOfFile GetLocalTime SystemTimeToFileTime WideCharToMultiByte GetTickCount FlushFileBuffers CreateFileA GetTempPathW WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle RtlUnwind InitializeCriticalSectionAndSpinCount LoadLibraryA HeapReAlloc VirtualAlloc HeapSize ReadFile GetLastError CloseHandle WriteFile SetFilePointer CreateFileW GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId HeapAlloc RaiseException HeapFree Sleep ExitProcess GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetConsoleCP GetConsoleMode EnterCriticalSection LeaveCriticalSection MultiByteToWideChar LCMapStringA

user32

LoadStringW LoadAcceleratorsW LoadIconW GetDesktopWindow EndDialog PostQuitMessage EndPaint BeginPaint DefWindowProcW DestroyWindow DialogBoxParamW UpdateWindow ShowWindow CreateWindowExW RegisterClassExW LoadCursorW

advapi32

CryptDestroyHash CryptHashData CryptReleaseContext CryptCreateHash CryptAcquireContextW CryptGetHashParam

wininet

InternetConnectW FtpSetCurrentDirectoryW FtpPutFileW InternetCloseHandle InternetOpenUrlW InternetReadFile InternetOpenW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-07_4bc0e5f4195a1cd0307501c1da364443_elex_rhadamanthys_stop

kernel32

user32

advapi32

wininet

generic