2026-09-29_4633516166dd59482e49d44b2fe06b5a_elex_hijackloader_rhadamanthys_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_4633516166dd59482e49d44b2fe06b5a_elex_hijackloader_rhadamanthys_stealc_stop
Size 147KB
Sample260930-1a8qysxtaz
SHA256 1b906d861d96cca45b65827670e03332d1cec9e829f2c30ac554f5d6093f17e8
MD5 4633516166dd59482e49d44b2fe06b5a
SHA1 9d3bd03d505708a778055b15827259c432a29d32
SHA512 c72ced168843288fa70a6dbf4e23fea2679b08b07af4ac49bd5c3b714a6d469a7514d22429654cb592e05192252a9e44a915fd3caabbf12e6cb5b9b1ed60d9d9
SSDEEP 3072:bRWBesJ/Pn9D6tim4NmbaWvgJbnD+TsC0QON5NTo:bRdglYbwJDC0QON5NTo
TLSH
T165E3AE027496C472FC1586356087DE7B5E3739A82B2348C33BD9569F4F322D6DF2A282
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-09-29_4633516166dd59482e49d44b2fe06b5a_elex_hijackloader_rhadamanthys_stealc_stop

.exe 147KB

2026-09-29_4633516166dd59482e49d44b2fe06b5a_elex_hijackloader_rhadamanthys_stealc_stop

IMPHASH 692bc0acc373e1333df5b307bd7dff0f
SHA256 1b906d861d96cca45b65827670e03332d1cec9e829f2c30ac554f5d6093f17e8
MD5 4633516166dd59482e49d44b2fe06b5a
SHA1 9d3bd03d505708a778055b15827259c432a29d32
SHA512 c72ced168843288fa70a6dbf4e23fea2679b08b07af4ac49bd5c3b714a6d469a7514d22429654cb592e05192252a9e44a915fd3caabbf12e6cb5b9b1ed60d9d9
SSDEEP 3072:bRWBesJ/Pn9D6tim4NmbaWvgJbnD+TsC0QON5NTo:bRdglYbwJDC0QON5NTo
TLSH
T165E3AE027496C472FC1586356087DE7B5E3739A82B2348C33BD9569F4F322D6DF2A282
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

f5:88:db:36:e4:e1:23:ee:f6:06:70:90:24:97:d0:59:fa:aa:39:2d:24:85:08:2a:c6:31:31:82:8f:cc:55:2a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=SoftEther Corporation,O=SoftEther Corporation,ST=Ibaraki,C=JP

Chains

Apr 15, 2025

CN=SoftEther Corporation,O=SoftEther Corporation,ST=Ibaraki,C=JP

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=SoftEther Corporation,O=SoftEther Corporation,ST=Ibaraki,C=JP

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Digest

7e:83:ff:6a:94:13:ff:d6:4c:38:99:a9:3f:75:cf:d7:d3:e4:06:00

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=SoftEther Corporation,O=SoftEther Corporation,ST=Ibaraki,C=JP

Chains

Apr 15, 2025

CN=SoftEther Corporation,O=SoftEther Corporation,ST=Ibaraki,C=JP

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=SoftEther Corporation,O=SoftEther Corporation,ST=Ibaraki,C=JP

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=SoftEther Corporation,O=SoftEther Corporation,ST=Ibaraki,C=JP

Serial Number

f1:8d:45:d8:09:2f:ce:7d:83:51:fc:ac:cc:cb:5c:35

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 6, 2023 - Jan 5, 2026

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Minor OS version

Major OS version

Entry point

11428

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\tmp\softether_build_dir\Main\DebugFiles\pdb\Win32_Release\vpncmdsys.pdb

kernel32

CreateProcessW WaitForSingleObject GetExitCodeProcess GetCommandLineW CreateProcessA GetVersionExA GetLastError WideCharToMultiByte MultiByteToWideChar InterlockedIncrement InterlockedDecrement GetCommandLineA HeapFree HeapAlloc GetProcessHeap TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo GetACP GetOEMCP IsValidCodePage GetModuleHandleA GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId EnterCriticalSection LeaveCriticalSection DeleteCriticalSection ExitProcess Sleep GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringA LCMapStringW RtlUnwind VirtualAlloc HeapReAlloc InitializeCriticalSection LoadLibraryA SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers GetLocaleInfoW HeapSize SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CloseHandle CreateFileA

advapi32

RegQueryValueExA RegCloseKey RegOpenKeyA

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_4633516166dd59482e49d44b2fe06b5a_elex_hijackloader_rhadamanthys_stealc_stop

kernel32

advapi32

generic