2026-09-28_037f5064d2ab7e6188a3484d0f10e827_elex_maze_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-28_037f5064d2ab7e6188a3484d0f10e827_elex_maze_rhadamanthys_stop
Size 310KB
Sample260929-pp6pcszepf
SHA256 14d7938aa07bc84f2138ffc1ca1c3a30e6ac48c2bae2097bbd775d82ffb8cd74
MD5 037f5064d2ab7e6188a3484d0f10e827
SHA1 7b88a8bf636958464d041dc19196f95dc6fd0f1b
SHA512 e105da3ca677f547123d7efbaf229f88c5ec2f0cd1648ee170cadab02c5f87e8619eda86625aa5faa0f2b5d608cdbc5486c6cd76419c0d06f7da08b8ac252cd3
SSDEEP 3072:89TzOXfXqWpMcEIWYAQzZ9abgEp+bWuQfDcld2umg71F2xbpiuib:ETzOXfdN7fabg8gld2lxFQb
TLSH
T16C648E1366DC7CE2C03262B137BB93F1D72EEC6149A1C50E66C43EA99A7C14376227D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-09-28_037f5064d2ab7e6188a3484d0f10e827_elex_maze_rhadamanthys_stop

.exe 310KB

2026-09-28_037f5064d2ab7e6188a3484d0f10e827_elex_maze_rhadamanthys_stop

IMPHASH ea5d3e42fef11ede53a318a4f97a7988
SHA256 14d7938aa07bc84f2138ffc1ca1c3a30e6ac48c2bae2097bbd775d82ffb8cd74
MD5 037f5064d2ab7e6188a3484d0f10e827
SHA1 7b88a8bf636958464d041dc19196f95dc6fd0f1b
SHA512 e105da3ca677f547123d7efbaf229f88c5ec2f0cd1648ee170cadab02c5f87e8619eda86625aa5faa0f2b5d608cdbc5486c6cd76419c0d06f7da08b8ac252cd3
SSDEEP 3072:89TzOXfXqWpMcEIWYAQzZ9abgEp+bWuQfDcld2umg71F2xbpiuib:ETzOXfdN7fabg8gld2lxFQb
TLSH
T16C648E1366DC7CE2C03262B137BB93F1D72EEC6149A1C50E66C43EA99A7C14376227D6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

d3:3a:ee:d8:fc:69:09:11:33:5d:b3:35:a0:bc:c7:ab:f3:d9:81:56:4a:99:59:82:5c:75:7d:54:ab:67:d1:ef

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Yahoo Holdings Inc.,O=Yahoo Holdings Inc.,L=New York,ST=New York,C=US

Chains

Jun 9, 2026

CN=Yahoo Holdings Inc.,O=Yahoo Holdings Inc.,L=New York,ST=New York,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Yahoo Holdings Inc.,O=Yahoo Holdings Inc.,L=New York,ST=New York,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Yahoo Holdings Inc.,O=Yahoo Holdings Inc.,L=New York,ST=New York,C=US

Serial Number

09:23:68:25:53:bc:b4:97:83:52:2b:19:d8:1b:e4:eb

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 15, 2026 - Jan 14, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

53464

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Stash\lowkey_proxyEXE\bin\Release\ProxyExe.pdb

kernel32

CreateFileW WriteFile lstrlenW GetLastError LocalAlloc RaiseException InitializeCriticalSectionEx DeleteCriticalSection LoadResource LockResource SizeofResource FindResourceW FindResourceExW GetModuleHandleW Process32NextW GetModuleFileNameW HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap GetFileAttributesW CreateProcessW SetEndOfFile OutputDebugStringW WriteConsoleW SetStdHandle CloseHandle OpenProcess Process32FirstW DecodePointer CreateToolhelp32Snapshot WideCharToMultiByte MultiByteToWideChar GetStringTypeW EncodePointer EnterCriticalSection LeaveCriticalSection GetCPInfo GetCommandLineW RtlUnwind IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetProcAddress LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsDebuggerPresent GetStdHandle GetFileType IsValidCodePage GetACP GetOEMCP GetCurrentThreadId ExitProcess GetModuleHandleExW AreFileApisANSI GetConsoleCP GetConsoleMode ReadFile SetFilePointerEx FlushFileBuffers QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW ReadConsoleW LoadLibraryExW

user32

AllowSetForegroundWindow WaitForInputIdle

advapi32

GetTokenInformation OpenProcessToken GetUserNameW LookupAccountSidW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-28_037f5064d2ab7e6188a3484d0f10e827_elex_maze_rhadamanthys_stop

kernel32

user32

advapi32

generic