2026-08-20_99564d60cc1a93c751d50556bb8e19bc_elex_rhadamanthys_stop

General

Target
2026-08-20_99564d60cc1a93c751d50556bb8e19bc_elex_rhadamanthys_stop
Size 403KB
Sample260820-1en74swalg
SHA256 633c2a6dcd6c432b35ea6ec135fa395a9b7d39b90014d3f2700fa4012370071a
MD5 99564d60cc1a93c751d50556bb8e19bc
SHA1 3a493edd2549b77320c80875dd5a3741465f4f3f
SHA512 54e51a3576e7fda732e6351298664c83bac82d3ba2ab4517b42d75452c8f11a2f1a234b837c4cb0d22f63be71e977e94f1af4f9c4d648731279dcf205c9e45f9
SSDEEP 6144:Y0z1Jb4JeVkWxhuWhI09LzFozyF6DqDyObMiRXFJZmirO5+pDdJF:Y0zcGkW99LzFGykPmZtZRaEpD
TLSH
T1FB945BD1B204BFE3E28951BA5C4A877A79F07C03BF214783F693F75E4A752926623112
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_99564d60cc1a93c751d50556bb8e19bc_elex_rhadamanthys_stop

File Explorer

2026-08-20_99564d60cc1a93c751d50556bb8e19bc_elex_rhadamanthys_stop

.exe 403KB

2026-08-20_99564d60cc1a93c751d50556bb8e19bc_elex_rhadamanthys_stop

IMPHASH 14d768f6df31e7e00493ce3dfa9c54f5
SHA256 633c2a6dcd6c432b35ea6ec135fa395a9b7d39b90014d3f2700fa4012370071a
MD5 99564d60cc1a93c751d50556bb8e19bc
SHA1 3a493edd2549b77320c80875dd5a3741465f4f3f
SHA512 54e51a3576e7fda732e6351298664c83bac82d3ba2ab4517b42d75452c8f11a2f1a234b837c4cb0d22f63be71e977e94f1af4f9c4d648731279dcf205c9e45f9
SSDEEP 6144:Y0z1Jb4JeVkWxhuWhI09LzFozyF6DqDyObMiRXFJZmirO5+pDdJF:Y0zcGkW99LzFGykPmZtZRaEpD
TLSH
T1FB945BD1B204BFE3E28951BA5C4A877A79F07C03BF214783F693F75E4A752926623112
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

6

Entry point

18316

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

OneDrive.pdb

kernel32

FreeLibrary GetProcAddress LocalFree LoadLibraryW SetDllDirectoryW CloseHandle WriteConsoleW SetFilePointerEx SetStdHandle GetCommandLineW EncodePointer DecodePointer RaiseException RtlUnwind GetLastError SetLastError InterlockedIncrement InterlockedDecrement GetCurrentThreadId ExitProcess GetModuleHandleExW MultiByteToWideChar GetStdHandle WriteFile GetModuleFileNameW GetProcessHeap GetFileType InitializeCriticalSectionAndSpinCount DeleteCriticalSection InitOnceExecuteOnce GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime GetTickCount64 GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter FlsAlloc FlsGetValue FlsSetValue FlsFree GetCurrentProcess TerminateProcess GetModuleHandleW IsProcessorFeaturePresent HeapAlloc HeapFree HeapSize Sleep IsDebuggerPresent EnterCriticalSection LeaveCriticalSection IsValidCodePage GetACP GetOEMCP GetCPInfo LoadLibraryExW OutputDebugStringW WideCharToMultiByte LCMapStringEx HeapReAlloc GetStringTypeW FlushFileBuffers GetConsoleCP GetConsoleMode CreateFileW

shell32

CommandLineToArgvW

shlwapi

SHGetValueW

Name

.text

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

194KB

Virtual Size

194KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

PACK

Size

144KB

Virtual Size

380KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_99564d60cc1a93c751d50556bb8e19bc_elex_rhadamanthys_stop

kernel32

shell32

shlwapi

generic