2026-08-30_5538a475089842ec699c9db684f5f2de_elex_ramnit_rhadamanthys_stop

General

Target
2026-08-30_5538a475089842ec699c9db684f5f2de_elex_ramnit_rhadamanthys_stop
Size 256KB
Sample260831-nb8fcsga65
SHA256 c17c003ae30d00e0d501485b96917389919286cf3287a0a2a609674543dfb029
MD5 5538a475089842ec699c9db684f5f2de
SHA1 147a32a93aa266ad8b6df3eb68a4e18f3eacb6b9
SHA512 5915d57a31a52d2f5384753e0c82baa23a7cb6d4c166c4b03131b93d9a7cb48ac71099a3ea0957dd6e43cfe69bd0d3cfb505b25b09f55295b715bc0b15cf5421
SSDEEP 3072:4JdPkdAT57NQrFjWxLy5bJT3PJFVMvbBb23L0BFTXELVSWkFB:47kj9bN3H6vB2oBFDKSh3
TLSH
T13A440101B5A3D473F650907088C8C1C327BEF9273166D6E7FF4DA8865D722E521BAAE4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-30_5538a475089842ec699c9db684f5f2de_elex_ramnit_rhadamanthys_stop

File Explorer

2026-08-30_5538a475089842ec699c9db684f5f2de_elex_ramnit_rhadamanthys_stop

.exe 256KB

2026-08-30_5538a475089842ec699c9db684f5f2de_elex_ramnit_rhadamanthys_stop

IMPHASH 5b7afc2e17977d2ae155f0eeb9559c3e
SHA256 c17c003ae30d00e0d501485b96917389919286cf3287a0a2a609674543dfb029
MD5 5538a475089842ec699c9db684f5f2de
SHA1 147a32a93aa266ad8b6df3eb68a4e18f3eacb6b9
SHA512 5915d57a31a52d2f5384753e0c82baa23a7cb6d4c166c4b03131b93d9a7cb48ac71099a3ea0957dd6e43cfe69bd0d3cfb505b25b09f55295b715bc0b15cf5421
SSDEEP 3072:4JdPkdAT57NQrFjWxLy5bJT3PJFVMvbBb23L0BFTXELVSWkFB:47kj9bN3H6vB2oBFDKSh3
TLSH
T13A440101B5A3D473F650907088C8C1C327BEF9273166D6E7FF4DA8865D722E521BAAE4
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

86016

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

s:\dev\apos\aefilters\aefilterssrv\release-sigmatel\AESTSrv.pdb

advapi32

RegEnumKeyExA RegOpenKeyA RegQueryValueExA RegCloseKey RegOpenKeyExA RegCreateKeyExA RegSetValueExA RegNotifyChangeKeyValue OpenSCManagerA OpenServiceA CloseServiceHandle StartServiceA StartServiceCtrlDispatcherA RegisterServiceCtrlHandlerA SetServiceStatus RegisterEventSourceA ReportEventA DeregisterEventSource CreateServiceA ControlService QueryServiceStatus DeleteService ConvertStringSecurityDescriptorToSecurityDescriptorA InitializeSecurityDescriptor

kernel32

SetFilePointer CreateThread SetThreadPriority ResumeThread GetModuleHandleA GetModuleFileNameA lstrlenA SetEvent WaitForSingleObject CloseHandle Sleep WriteFile CreateFileA GetLastError CreateEventA WaitForMultipleObjects GetLocalTime GetDateFormatA GetTimeFormatA MultiByteToWideChar SetConsoleCtrlHandler FormatMessageA LocalFree CreateNamedPipeA ResetEvent ConnectNamedPipe ReadFile GetOverlappedResult DisconnectNamedPipe InterlockedExchange GetACP GetLocaleInfoA GetThreadLocale GetVersionExA FlushFileBuffers WriteConsoleW GetConsoleOutputCP HeapFree HeapReAlloc HeapAlloc GetProcAddress ExitProcess GetCommandLineA GetProcessHeap TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapDestroy HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapSize GetCPInfo InterlockedIncrement InterlockedDecrement GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId GetStdHandle LoadLibraryA InitializeCriticalSection FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetConsoleCP GetConsoleMode RtlUnwind LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW SetStdHandle WriteConsoleA

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-30_5538a475089842ec699c9db684f5f2de_elex_ramnit_rhadamanthys_stop

advapi32

kernel32

generic