2026-08-07_edb50e982551b6b5845c176a6a23083e_elex_karagany_mafia_redline-stealer_rhadamanthys

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-07_edb50e982551b6b5845c176a6a23083e_elex_karagany_mafia_redline-stealer_rhadamanthys
Size 152KB
Sample260808-ar4kfsem6w
SHA256 989d1d2156d140442c3172d7dcaed8bfbd95a649e55e5dba6fedde4786e9c5c1
MD5 edb50e982551b6b5845c176a6a23083e
SHA1 1229b289ebf4aa8d02355a110839c98bbb36fdbe
SHA512 b5b55e4cc3e98f82267d18f1127cd953d5eeb66158daa4aea85928b4d1e18ac588ce7fa2611c5105011170577abaf620c581a5152f4245c11f0a85104a0335fc
SSDEEP 1536:JnVbmIH2ctswvhpUhfC80+430GzWa8NeO9zrdknnvni9e7AzfAHlHJ7oC:Xb/H2ctswvIhCQGyd9tIi9e7qfAFHv
TLSH
T163E30620AD9440FDD51AA4778C4F86634A1ABC588A915E8F2EF734FD1F38693827523E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-07_edb50e982551b6b5845c176a6a23083e_elex_karagany_mafia_redline-stealer_rhadamanthys

.exe 152KB

2026-08-07_edb50e982551b6b5845c176a6a23083e_elex_karagany_mafia_redline-stealer_rhadamanthys

IMPHASH 0b17b47cf49cdeb33094be0042c3cc8c
SHA256 989d1d2156d140442c3172d7dcaed8bfbd95a649e55e5dba6fedde4786e9c5c1
MD5 edb50e982551b6b5845c176a6a23083e
SHA1 1229b289ebf4aa8d02355a110839c98bbb36fdbe
SHA512 b5b55e4cc3e98f82267d18f1127cd953d5eeb66158daa4aea85928b4d1e18ac588ce7fa2611c5105011170577abaf620c581a5152f4245c11f0a85104a0335fc
SSDEEP 1536:JnVbmIH2ctswvhpUhfC80+430GzWa8NeO9zrdknnvni9e7AzfAHlHJ7oC:Xb/H2ctswvIhCQGyd9tIi9e7qfAFHv
TLSH
T163E30620AD9440FDD51AA4778C4F86634A1ABC588A915E8F2EF734FD1F38693827523E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

3b:57:cb:8b:75:b9:65:d8:00:3c:65:2b:dd:10:79:30:23:87:bc:e4:22:74:d2:70:6a:25:6a:34:20:59:44:cc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=上海生趣网络科技有限公司,O=上海生趣网络科技有限公司,L=上海市,ST=上海市,C=CN

Chains

Aug 6, 2026

CN=上海生趣网络科技有限公司,O=上海生趣网络科技有限公司,L=上海市,ST=上海市,C=CN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=上海生趣网络科技有限公司,O=上海生趣网络科技有限公司,L=上海市,ST=上海市,C=CN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=上海生趣网络科技有限公司,O=上海生趣网络科技有限公司,L=上海市,ST=上海市,C=CN

Serial Number

1a:b0:e6:c5:52:09:ce:5a:2a:75:2a:4d

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 18, 2025 - Nov 18, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

10036

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\Youzhuan\zbmf\WEMediaSetup - 副本\Bin\Release\WEMediaSetup.pdb

2026-08-07_edb50e982551b6b5845c176a6a23083e_elex_karagany_mafia_redline-stealer_rhadamanthys

kernel32

generic