General
- Target 2026-09-21_2a1afe9fe08b1c1af7b09184c0f8a703_elex_rhadamanthys_stealc_stop_tofsee
- Size 536KB
- Sample260922-cxf3fsdf82
- SHA256 c4c8c1c3cddce76cc1da08474098a53fe4a556a2c7441c785926e854bf9d196f
- MD5 2a1afe9fe08b1c1af7b09184c0f8a703
- SHA1 b806c2a52cbd7b561bd90c0a0d4f65f5e3fe01f7
- SHA512 7c822f2bdddc3a5c5ef9b2612ac55aa5ad99096e946ca5815b7f4c4fb953d91651d16a85216206ecb9011ccf66e0a0dd447e6beeb2525a65e3f08a72a29e1fde
- SSDEEP 12288:ip3pg/994wznStojPy0UfJHCw1d/GNOoMm0v:ip3pM94wzkojPyTH6M5v
- TLSH T18EC4E02E7080C03BD267DA348ED2D2756A79BC215829898FFBCD776F1F302919B19356
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-09-21_2a1afe9fe08b1c1af7b09184c0f8a703_elex_rhadamanthys_stealc_stop_tofsee.exe
Resource
win10v2004-20260911-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-21_2a1afe9fe08b1c1af7b09184c0f8a703_elex_rhadamanthys_stealc_stop_tofsee.exe
Resource
win11ltsc2024-20260911-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-21_2a1afe9fe08b1c1af7b09184c0f8a703_elex_rhadamanthys_stealc_stop_tofsee
- Size 536KB
- SHA256 c4c8c1c3cddce76cc1da08474098a53fe4a556a2c7441c785926e854bf9d196f
- MD5 2a1afe9fe08b1c1af7b09184c0f8a703
- SHA1 b806c2a52cbd7b561bd90c0a0d4f65f5e3fe01f7
- SHA512 7c822f2bdddc3a5c5ef9b2612ac55aa5ad99096e946ca5815b7f4c4fb953d91651d16a85216206ecb9011ccf66e0a0dd447e6beeb2525a65e3f08a72a29e1fde
- SSDEEP 12288:ip3pg/994wznStojPy0UfJHCw1d/GNOoMm0v:ip3pM94wzkojPyTH6M5v
- TLSH T18EC4E02E7080C03BD267DA348ED2D2756A79BC215829898FFBCD776F1F302919B19356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Drops desktop.ini file(s)
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
1