duptwux | 2026-09-01_02cb9cd5e150e88c96a5758e9134d7ff_elex_ganelp_redline-stealer_rhadamanthys_stop

General

Target
2026-09-01_02cb9cd5e150e88c96a5758e9134d7ff_elex_ganelp_redline-stealer_rhadamanthys_stop
Size 356KB
Sample260903-vpdapscm91
SHA256 fa28eb60393415b642dc71f33ab7c5fe0a33f24d8003455f23786a1a60cad495
MD5 02cb9cd5e150e88c96a5758e9134d7ff
SHA1 db95e0aed69d455de11cff096a68dbaa62abe48f
SHA512 be0a12949ef92256639f4e715c72908b934cb4db97dc1338196b116737fc82e9e3d5c2306987b92b6d908409ceb9e14f1a9263312692ed96e21418cf4a2ad78f
SSDEEP 3072:dVHgCc4xGvbwcU9KQ2BBAHmaPxuHVo17JECW77G0EvguCEFev5fD4uHDFSTtCc:gCc4xGxWKQ2BonxwE4MgxDITkc
TLSH
T111748D11F380C036E4A141B989B7CB71AA6D7E705B6862CB63D03A9E6F712D1BD3131B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

worm duptwux

Malware Config

Signatures

Family: Duptwux
Duptwux is a Windows worm written in C++.
worm duptwux

Detects Duptwux 1 IoCs

resource	yara_rule
sample	family_duptwux

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-01_02cb9cd5e150e88c96a5758e9134d7ff_elex_ganelp_redline-stealer_rhadamanthys_stop

File Explorer

2026-09-01_02cb9cd5e150e88c96a5758e9134d7ff_elex_ganelp_redline-stealer_rhadamanthys_stop

.exe 356KB

2026-09-01_02cb9cd5e150e88c96a5758e9134d7ff_elex_ganelp_redline-stealer_rhadamanthys_stop

IMPHASH 2cf2a9e0f8c6a675c5f2e30fd0e214f6
SHA256 fa28eb60393415b642dc71f33ab7c5fe0a33f24d8003455f23786a1a60cad495
MD5 02cb9cd5e150e88c96a5758e9134d7ff
SHA1 db95e0aed69d455de11cff096a68dbaa62abe48f
SHA512 be0a12949ef92256639f4e715c72908b934cb4db97dc1338196b116737fc82e9e3d5c2306987b92b6d908409ceb9e14f1a9263312692ed96e21418cf4a2ad78f
SSDEEP 3072:dVHgCc4xGvbwcU9KQ2BBAHmaPxuHVo17JECW77G0EvguCEFev5fD4uHDFSTtCc:gCc4xGxWKQ2BonxwE4MgxDITkc
TLSH
T111748D11F380C036E4A141B989B7CB71AA6D7E705B6862CB63D03A9E6F712D1BD3131B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Duptwux
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

330381

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

getpeername recv socket ioctlsocket select closesocket recvfrom inet_ntoa htons htonl inet_addr sendto send gethostbyname __WSAFDIsSet connect WSAStartup

kernel32

WriteProcessMemory GetProcAddress LoadLibraryA ReadProcessMemory GetCurrentProcess GetModuleHandleA ReadFile CreateDirectoryA DeleteFileA GetFileAttributesA SetEndOfFile SetFilePointer FindFirstFileA GetDriveTypeA GetLogicalDrives lstrcpynA WideCharToMultiByte MultiByteToWideChar GetLastError Process32Next Process32First CreateToolhelp32Snapshot FlushViewOfFile UnmapViewOfFile GetVersionExA GetSystemDirectoryA GetWindowsDirectoryA GetModuleFileNameA CreateThread Sleep SetFileAttributesA CreateFileA GetFileSize CreateFileMappingA MapViewOfFile WriteFile CloseHandle FindNextFileA HeapSize HeapReAlloc VirtualAlloc InitializeCriticalSectionAndSpinCount GetLocaleInfoA EnterCriticalSection GetCommandLineA GetStartupInfoA RtlUnwind TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId ExitProcess GetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection HeapCreate VirtualFree HeapFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapAlloc RaiseException LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW LeaveCriticalSection

advapi32

RegDeleteKeyA QueryServiceConfigA ChangeServiceConfigA StartServiceA CreateServiceA OpenServiceA QueryServiceStatus SetServiceStatus RegCreateKeyA RegOpenKeyA RegQueryValueExA RegCreateKeyExA RegSetValueExA RegCloseKey OpenSCManagerA StartServiceCtrlDispatcherA RegisterServiceCtrlHandlerA

shell32

ShellExecuteA

Name

.text

Size

152KB

Virtual Size

150KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

16KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

16KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

136KB

Virtual Size

133KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-01_02cb9cd5e150e88c96a5758e9134d7ff_elex_ganelp_redline-stealer_rhadamanthys_stop

ws2_32

kernel32

advapi32

shell32

generic