6538a57e565ce05ecf7a435b2904afa01531de3d2c8df4041162f6c3fc7af462

General

Target
2026-08-27_1e88a72e36dc577b5ad38e8cc2e9dbaa_elex_rhadamanthys_stop
Size 1.9MB
Sample260827-1kt1jszyb1
SHA256 6538a57e565ce05ecf7a435b2904afa01531de3d2c8df4041162f6c3fc7af462
MD5 1e88a72e36dc577b5ad38e8cc2e9dbaa
SHA1 971644e6318611f3780d7fb4152f95ae2118679d
SHA512 f564890068e6f90ff3aef3c342d624cd3bc15063a692f6c2363d853127a72cb9f10e526a7d0d845572d915554f2f399ca6dcf4197933390030e03cef9315317f
SSDEEP 3072:2xh0oLKfdAkFDHj+nStkJOh+p3ZSNwG0qE/6GcXH:Ah0XSOqnvohPa16f
TLSH
T1B095CF0076D0FCBBE5B5467148B69B319B3ABD365B2ACC83B358564E0932184B7763CB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-27_1e88a72e36dc577b5ad38e8cc2e9dbaa_elex_rhadamanthys_stop
- Size 1.9MB
- SHA256 6538a57e565ce05ecf7a435b2904afa01531de3d2c8df4041162f6c3fc7af462
- MD5 1e88a72e36dc577b5ad38e8cc2e9dbaa
- SHA1 971644e6318611f3780d7fb4152f95ae2118679d
- SHA512 f564890068e6f90ff3aef3c342d624cd3bc15063a692f6c2363d853127a72cb9f10e526a7d0d845572d915554f2f399ca6dcf4197933390030e03cef9315317f
- SSDEEP 3072:2xh0oLKfdAkFDHj+nStkJOh+p3ZSNwG0qE/6GcXH:Ah0XSOqnvohPa16f
- TLSH
  T1B095CF0076D0FCBBE5B5467148B69B319B3ABD365B2ACC83B358564E0932184B7763CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

adware defense_evasion discovery execution persistence spyware stealer ransomware
- Detects Windows executables referencing non-Windows User-Agents
- Detects executables referencing many email and collaboration clients. Observed in information steale
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2