2026-08-15_030e59c5d15ff759edffdaae5d720827_elex_rhadamanthys_stealc_stop

General

Target
2026-08-15_030e59c5d15ff759edffdaae5d720827_elex_rhadamanthys_stealc_stop
Size 641KB
Sample260815-e2x8msztbs
SHA256 e316baeae4d4498f1cd93688ff965316659b85c489bc2cc31ec4fa15f7ef0f1c
MD5 030e59c5d15ff759edffdaae5d720827
SHA1 1891d914197e7b8cb23552e52a99c2d1af98be05
SHA512 246c543e10707786fcdb1b0e36cf38673323b686dfad315097a7b5f456167bbee0100aea1cde98fb1036360a60c2ead9639aeaab944b0dccab8340adf18d7d7f
SSDEEP 12288:ueh6aiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:uf8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T153D412927581D031E6FD107849A1847165592D268B7D84D3B3483B2EAF7FBFA9E3C232
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-15_030e59c5d15ff759edffdaae5d720827_elex_rhadamanthys_stealc_stop

File Explorer

2026-08-15_030e59c5d15ff759edffdaae5d720827_elex_rhadamanthys_stealc_stop

.exe 641KB

2026-08-15_030e59c5d15ff759edffdaae5d720827_elex_rhadamanthys_stealc_stop

IMPHASH f4802917e520df22ed5eb1cf8f86570b
SHA256 e316baeae4d4498f1cd93688ff965316659b85c489bc2cc31ec4fa15f7ef0f1c
MD5 030e59c5d15ff759edffdaae5d720827
SHA1 1891d914197e7b8cb23552e52a99c2d1af98be05
SHA512 246c543e10707786fcdb1b0e36cf38673323b686dfad315097a7b5f456167bbee0100aea1cde98fb1036360a60c2ead9639aeaab944b0dccab8340adf18d7d7f
SSDEEP 12288:ueh6aiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:uf8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T153D412927581D031E6FD107849A1847165592D268B7D84D3B3483B2EAF7FBFA9E3C232
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

10096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\DR\loc\build\OOD\work\current\bin\vc10\Win32\Unicode Static Release\oodwrtlic.pdb

kernel32

GetACP GetOEMCP IsValidCodePage EncodePointer TlsAlloc TlsGetValue TlsSetValue DecodePointer TlsFree SetLastError GetCurrentThreadId UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess ExitProcess WriteFile GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW DeleteCriticalSection HeapCreate QueryPerformanceCounter InterlockedDecrement GetCurrentProcessId GetSystemTimeAsFileTime WideCharToMultiByte LCMapStringW MultiByteToWideChar GetStringTypeW LeaveCriticalSection EnterCriticalSection Sleep LoadLibraryW RaiseException SetFilePointer GetConsoleCP GetConsoleMode IsProcessorFeaturePresent HeapReAlloc HeapSize SetStdHandle WriteConsoleW CreateFileW CloseHandle FlushFileBuffers InterlockedIncrement GetCPInfo HeapAlloc HeapFree GetLastError RtlUnwind HeapSetInformation GetCommandLineW GetSystemInfo GetModuleHandleW GetTickCount GetProcAddress

advapi32

RegEnumKeyExW RegQueryInfoKeyW RegDeleteValueW RegEnumKeyW RegDeleteKeyW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryValueExW RegCloseKey RegEnumValueW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-15_030e59c5d15ff759edffdaae5d720827_elex_rhadamanthys_stealc_stop

kernel32

advapi32

generic