2026-09-07_ab46e59a27b662b2315a34ce372c478b_elex_mafia_rhadamanthys_stealc_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-07_ab46e59a27b662b2315a34ce372c478b_elex_mafia_rhadamanthys_stealc_stop_tofsee
Size 200KB
Sample260908-kfglnavxbs
SHA256 a58b16cf90f1d79cc6ee9cd3b188716445845d03712480294715756e51df4fd4
MD5 ab46e59a27b662b2315a34ce372c478b
SHA1 ae84f576f2e3622f7a74abc83ff4511c92a34e0b
SHA512 d7e99e576abe0c22daab2758f33427e117bc6888837b2f85dbdf7c32c294db0d975ba5702e198152e02be9a8a4ae8b9d24e2369313c63c44857f109eb3d8c871
SSDEEP 3072:R+TjU5VeOBNX3sU+Jyk5nPlq3MGI6JsAY1+u5dJgzT:R+TYBNMPgkRI3+Ws51Jj+zT
TLSH
T114146C353281C033D9A715748EF8C77A5ABEB832076554CBB7E40B799F643E28A3534A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-07_ab46e59a27b662b2315a34ce372c478b_elex_mafia_rhadamanthys_stealc_stop_tofsee

File Explorer

2026-09-07_ab46e59a27b662b2315a34ce372c478b_elex_mafia_rhadamanthys_stealc_stop_tofsee

.exe 200KB

2026-09-07_ab46e59a27b662b2315a34ce372c478b_elex_mafia_rhadamanthys_stealc_stop_tofsee

IMPHASH f12ee1770fc152528066e6264bab5ed3
SHA256 a58b16cf90f1d79cc6ee9cd3b188716445845d03712480294715756e51df4fd4
MD5 ab46e59a27b662b2315a34ce372c478b
SHA1 ae84f576f2e3622f7a74abc83ff4511c92a34e0b
SHA512 d7e99e576abe0c22daab2758f33427e117bc6888837b2f85dbdf7c32c294db0d975ba5702e198152e02be9a8a4ae8b9d24e2369313c63c44857f109eb3d8c871
SSDEEP 3072:R+TjU5VeOBNX3sU+Jyk5nPlq3MGI6JsAY1+u5dJgzT:R+TYBNMPgkRI3+Ws51Jj+zT
TLSH
T114146C353281C033D9A715748EF8C77A5ABEB832076554CBB7E40B799F643E28A3534A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

69262

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

HeapFree HeapAlloc GetProcessHeap OpenProcess GetProcAddress GetSystemTime TerminateProcess FindClose FindNextFileA FindFirstFileA SetConsoleTextAttribute GetStdHandle GetModuleHandleA ExitProcess GetVolumeInformationA WriteFile GetConsoleWindow WriteProcessMemory VirtualAllocEx Sleep WaitForSingleObject CreateProcessA CopyFileA GetTempPathA IsDebuggerPresent SetConsoleTitleA CompareStringW SetEndOfFile CreateFileW GetExitCodeProcess SetStdHandle IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetStringTypeW GetCurrentProcessId GetTickCount QueryPerformanceCounter WideCharToMultiByte GetCurrentProcess GetLastError CreateFileA CloseHandle GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA GetFileAttributesA GetLocaleInfoW LoadLibraryW SetFilePointer ReadFile GetStartupInfoW SetEnvironmentVariableA DeleteFileA SetHandleCount InitializeCriticalSectionAndSpinCount FlushFileBuffers GetConsoleMode GetConsoleCP InterlockedIncrement InterlockedDecrement InterlockedExchange MultiByteToWideChar InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection EncodePointer DecodePointer RaiseException RtlUnwind GetSystemTimeAsFileTime HeapReAlloc GetModuleHandleW WriteConsoleW GetFileType GetModuleFileNameW GetCommandLineA HeapSetInformation LCMapStringW GetCPInfo IsProcessorFeaturePresent GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId UnhandledExceptionFilter SetUnhandledExceptionFilter HeapSize HeapCreate

user32

RegisterWindowMessageA GetWindowRect MessageBoxA FindWindowA LoadIconA DefWindowProcA CreateWindowExA SetWindowPos RegisterClassExA GetSystemMetrics DestroyIcon LoadCursorA

advapi32

RegSetValueExA RegOpenKeyExA AdjustTokenPrivileges RegCloseKey OpenProcessToken LookupPrivilegeValueA

shell32

Shell_NotifyIconA ShellExecuteA

wininet

InternetConnectW InternetReadFile InternetCloseHandle HttpSendRequestW HttpOpenRequestW

iphlpapi

GetAdaptersInfo

psapi

EnumProcessModules EnumProcesses GetModuleBaseNameA

urlmon

URLDownloadToFileA

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-07_ab46e59a27b662b2315a34ce372c478b_elex_mafia_rhadamanthys_stealc_stop_tofsee

kernel32

user32

advapi32

shell32

wininet

iphlpapi

psapi

urlmon

generic