8ba9206f0cb87a21ada992dac8060566b917008b96f028e0d9fa5f1b6cb9d2c9

General

Target
2026-09-06_5af9d05a9ce9ca6f0389c33b9833bfbf_elex_rhadamanthys_stop
Size 2.2MB
Sample260907-c972psed45
SHA256 8ba9206f0cb87a21ada992dac8060566b917008b96f028e0d9fa5f1b6cb9d2c9
MD5 5af9d05a9ce9ca6f0389c33b9833bfbf
SHA1 6bb0805e03f0569a01e3544f20c105488e7f0000
SHA512 a82468172fbc7cee4fc4e55cbb0104e3aad11aee6c4b1c6f37750f156762747a8c87dacbdd7b035f8f55c0cbfba0371c0484fe4cf3385f205cd8b48fb4fe5c21
SSDEEP 3072:2xh0oLKfdAkFDHj+nStkJOh+p3ZSNwG0qE/6GcX:Ah0XSOqnvohPa16
TLSH
T1D9A5CF0076D0FCBBE5B5467148B69B319B3ABD365B2ACC83B358564E0932184B7763CB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-06_5af9d05a9ce9ca6f0389c33b9833bfbf_elex_rhadamanthys_stop
- Size 2.2MB
- SHA256 8ba9206f0cb87a21ada992dac8060566b917008b96f028e0d9fa5f1b6cb9d2c9
- MD5 5af9d05a9ce9ca6f0389c33b9833bfbf
- SHA1 6bb0805e03f0569a01e3544f20c105488e7f0000
- SHA512 a82468172fbc7cee4fc4e55cbb0104e3aad11aee6c4b1c6f37750f156762747a8c87dacbdd7b035f8f55c0cbfba0371c0484fe4cf3385f205cd8b48fb4fe5c21
- SSDEEP 3072:2xh0oLKfdAkFDHj+nStkJOh+p3ZSNwG0qE/6GcX:Ah0XSOqnvohPa16
- TLSH
  T1D9A5CF0076D0FCBBE5B5467148B69B319B3ABD365B2ACC83B358564E0932184B7763CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

adware defense_evasion discovery execution persistence spyware stealer ransomware
- Detects Windows executables referencing non-Windows User-Agents
- Detects executables referencing many email and collaboration clients. Observed in information steale
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2