dc97dfe6e2944150f3132f98180a41a8b7be8cb80c4f5bec375aeca8c143d958

General

Target
2026-08-23_98eb6e6597594bad67088b5f451b8f44_elex_rhadamanthys_stop
Size 2.0MB
Sample260824-eylensx1fx
SHA256 dc97dfe6e2944150f3132f98180a41a8b7be8cb80c4f5bec375aeca8c143d958
MD5 98eb6e6597594bad67088b5f451b8f44
SHA1 84ccb2fa93e8499bc8180af8e520c474d69a3338
SHA512 da3df1faf0dbce12e26cb198a28d961e54904f2335efee6a4c8fb6ce6871d50ae14da550c968b9a241e52da7e9e6daa25de3a7d386fe8c2a2aa61b8e13be0cbd
SSDEEP 3072:2xh0oLKfdAkFDHj+nStkJOh+p3ZSNwG0qE/6GcXh:Ah0XSOqnvohPa165
TLSH
T19FA5CF0076D0FCBBE5B5467148B69B319B3ABD365B2ACC83B358564E0932184B7763CB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-23_98eb6e6597594bad67088b5f451b8f44_elex_rhadamanthys_stop
- Size 2.0MB
- SHA256 dc97dfe6e2944150f3132f98180a41a8b7be8cb80c4f5bec375aeca8c143d958
- MD5 98eb6e6597594bad67088b5f451b8f44
- SHA1 84ccb2fa93e8499bc8180af8e520c474d69a3338
- SHA512 da3df1faf0dbce12e26cb198a28d961e54904f2335efee6a4c8fb6ce6871d50ae14da550c968b9a241e52da7e9e6daa25de3a7d386fe8c2a2aa61b8e13be0cbd
- SSDEEP 3072:2xh0oLKfdAkFDHj+nStkJOh+p3ZSNwG0qE/6GcXh:Ah0XSOqnvohPa165
- TLSH
  T19FA5CF0076D0FCBBE5B5467148B69B319B3ABD365B2ACC83B358564E0932184B7763CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

adware defense_evasion discovery execution persistence spyware stealer ransomware
- Custom signature
  
  Detects Windows executables referencing non-Windows User-Agents
- Custom signature
  
  Detects executables referencing many email and collaboration clients. Observed in information steale
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2