2026-08-29_f9d6e831e48acc285a1ff26ad0d15689_elex_mafia_rhadamanthys_stealc_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-29_f9d6e831e48acc285a1ff26ad0d15689_elex_mafia_rhadamanthys_stealc_stop_tofsee
Size 200KB
Sample260830-24dckstxev
SHA256 920be6b53fc2308b60e7795ae2b594a5ebdd9572706ab6c5680057a55f065313
MD5 f9d6e831e48acc285a1ff26ad0d15689
SHA1 d84aba96f8981ab35a0338dbb790e0d51945e824
SHA512 1dd3ff69fb9abc7cdaec8920904c45e50e29b94da7e7064b100893efc86bfb0eca18dc6c258325fcb03691a0d2ad8de6de64900fe71683cba99873398f7629a3
SSDEEP 3072:xW0005KZNBpPrEU2JOMRntNi3MGQ6JsIo1+XWiJcp8:xW0IBpIn0M3I32WsR18nKp8
TLSH
T15F147C353281C033D96715748EE8C77A5ABEB83207A554CBB7E40B799F643E28B3534A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-29_f9d6e831e48acc285a1ff26ad0d15689_elex_mafia_rhadamanthys_stealc_stop_tofsee

File Explorer

2026-08-29_f9d6e831e48acc285a1ff26ad0d15689_elex_mafia_rhadamanthys_stealc_stop_tofsee

.exe 200KB

2026-08-29_f9d6e831e48acc285a1ff26ad0d15689_elex_mafia_rhadamanthys_stealc_stop_tofsee

IMPHASH f12ee1770fc152528066e6264bab5ed3
SHA256 920be6b53fc2308b60e7795ae2b594a5ebdd9572706ab6c5680057a55f065313
MD5 f9d6e831e48acc285a1ff26ad0d15689
SHA1 d84aba96f8981ab35a0338dbb790e0d51945e824
SHA512 1dd3ff69fb9abc7cdaec8920904c45e50e29b94da7e7064b100893efc86bfb0eca18dc6c258325fcb03691a0d2ad8de6de64900fe71683cba99873398f7629a3
SSDEEP 3072:xW0005KZNBpPrEU2JOMRntNi3MGQ6JsIo1+XWiJcp8:xW0IBpIn0M3I32WsR18nKp8
TLSH
T15F147C353281C033D96715748EE8C77A5ABEB83207A554CBB7E40B799F643E28B3534A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

69262

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

HeapFree HeapAlloc GetProcessHeap OpenProcess GetProcAddress GetSystemTime TerminateProcess FindClose FindNextFileA FindFirstFileA SetConsoleTextAttribute GetStdHandle GetModuleHandleA ExitProcess GetVolumeInformationA WriteFile GetConsoleWindow WriteProcessMemory VirtualAllocEx Sleep WaitForSingleObject CreateProcessA CopyFileA GetTempPathA IsDebuggerPresent SetConsoleTitleA CompareStringW SetEndOfFile CreateFileW GetExitCodeProcess SetStdHandle IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetStringTypeW GetCurrentProcessId GetTickCount QueryPerformanceCounter WideCharToMultiByte GetCurrentProcess GetLastError CreateFileA CloseHandle GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA GetFileAttributesA GetLocaleInfoW LoadLibraryW SetFilePointer ReadFile GetStartupInfoW SetEnvironmentVariableA DeleteFileA SetHandleCount InitializeCriticalSectionAndSpinCount FlushFileBuffers GetConsoleMode GetConsoleCP InterlockedIncrement InterlockedDecrement InterlockedExchange MultiByteToWideChar InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection EncodePointer DecodePointer RaiseException RtlUnwind GetSystemTimeAsFileTime HeapReAlloc GetModuleHandleW WriteConsoleW GetFileType GetModuleFileNameW GetCommandLineA HeapSetInformation LCMapStringW GetCPInfo IsProcessorFeaturePresent GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId UnhandledExceptionFilter SetUnhandledExceptionFilter HeapSize HeapCreate

user32

RegisterWindowMessageA GetWindowRect MessageBoxA FindWindowA LoadIconA DefWindowProcA CreateWindowExA SetWindowPos RegisterClassExA GetSystemMetrics DestroyIcon LoadCursorA

advapi32

RegSetValueExA RegOpenKeyExA AdjustTokenPrivileges RegCloseKey OpenProcessToken LookupPrivilegeValueA

shell32

Shell_NotifyIconA ShellExecuteA

wininet

InternetConnectW InternetReadFile InternetCloseHandle HttpSendRequestW HttpOpenRequestW

iphlpapi

GetAdaptersInfo

psapi

EnumProcessModules EnumProcesses GetModuleBaseNameA

urlmon

URLDownloadToFileA

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-29_f9d6e831e48acc285a1ff26ad0d15689_elex_mafia_rhadamanthys_stealc_stop_tofsee

kernel32

user32

advapi32

shell32

wininet

iphlpapi

psapi

urlmon

generic