General
- Target 2026-09-29_fca335f3bbc406da14daadf500607448_elex_qilin_rhadamanthys
- Size 83KB
- Sample260929-qfbcja11fs
- SHA256 9e128dd05e6de6b286976e97da99ca879aaf07e0faa2c6a6f2b7d9c044757e12
- MD5 fca335f3bbc406da14daadf500607448
- SHA1 a255efd8919af9c38e396bf06832ce0119896c5f
- SHA512 aa4e7ea7cd513a9fa0b0056405ca9e020e1123ac2ca5c37fbefb864baf41ea75b24170b1744ddb2e0f506b8e99749ccb62e394a67f4e7c760ddb28bb45f16c3e
- SSDEEP 1536:e6q10k0EFjed6rqJ+6vghzwYu7vih9GueIh9j2IoHAjUvJQ/johleHhvGhZchUX8:E1oEFlt6vghzwYu7vih9GueIh9j2IoHi
- TLSH T17A834B578AA2CCEBD800003B67FAA67C86EBBC411DECB3968BDDCC1634D2914C95E557
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-09-29_fca335f3bbc406da14daadf500607448_elex_qilin_rhadamanthys.exe
Resource
win10v2004-20260911-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-29_fca335f3bbc406da14daadf500607448_elex_qilin_rhadamanthys.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
blihanstealer
Mutex
-
pomdfghrt
Attributes
-
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; CIBA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Targets
-
- Target 2026-09-29_fca335f3bbc406da14daadf500607448_elex_qilin_rhadamanthys
- Size 83KB
- SHA256 9e128dd05e6de6b286976e97da99ca879aaf07e0faa2c6a6f2b7d9c044757e12
- MD5 fca335f3bbc406da14daadf500607448
- SHA1 a255efd8919af9c38e396bf06832ce0119896c5f
- SHA512 aa4e7ea7cd513a9fa0b0056405ca9e020e1123ac2ca5c37fbefb864baf41ea75b24170b1744ddb2e0f506b8e99749ccb62e394a67f4e7c760ddb28bb45f16c3e
- SSDEEP 1536:e6q10k0EFjed6rqJ+6vghzwYu7vih9GueIh9j2IoHAjUvJQ/johleHhvGhZchUX8:E1oEFlt6vghzwYu7vih9GueIh9j2IoHi
- TLSH T17A834B578AA2CCEBD800003B67FAA67C86EBBC411DECB3968BDDCC1634D2914C95E557
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects executables built or packed with MPress PE compressor
-
Deletes itself
-
Executes dropped EXE
-
Adds Run key to start application