2026-09-29_2cf6fdd45bd73fa9af115598189c9111_elex_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_2cf6fdd45bd73fa9af115598189c9111_elex_rhadamanthys_stop
Size 1.1MB
Sample260930-ea4w4svcqe
SHA256 dfd63188e84112d9eb00af42fa7f1edd8b2f8a1a836401a971a4c298a0b9f334
MD5 2cf6fdd45bd73fa9af115598189c9111
SHA1 ac86bb319d53c95ddef6226779b0941710bb5377
SHA512 1f7cd0a702a337cd463bda048c22dfff386a33d55562459fb3b86c2719721501e7b59974bfb93202710bc31178d79474a2348b3b8a03305f2479474e4c6063fa
SSDEEP 24576:Aiu/p3I70p9B0cNwD3yL4G0d2VkXMhYR0Vv/REdTGDt4VgOK:wCI9BtwD/QSMqYv/Ri4AgO
TLSH
T1E4450115F781C033D5A2107A9AA9C77E693A7A75072A54C3B7D82F75BF203D0AA3530E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_2cf6fdd45bd73fa9af115598189c9111_elex_rhadamanthys_stop

File Explorer

2026-09-29_2cf6fdd45bd73fa9af115598189c9111_elex_rhadamanthys_stop

.exe 1.1MB

2026-09-29_2cf6fdd45bd73fa9af115598189c9111_elex_rhadamanthys_stop

IMPHASH 47d9c05d55bbc3899f831347ecc6bf93
SHA256 dfd63188e84112d9eb00af42fa7f1edd8b2f8a1a836401a971a4c298a0b9f334
MD5 2cf6fdd45bd73fa9af115598189c9111
SHA1 ac86bb319d53c95ddef6226779b0941710bb5377
SHA512 1f7cd0a702a337cd463bda048c22dfff386a33d55562459fb3b86c2719721501e7b59974bfb93202710bc31178d79474a2348b3b8a03305f2479474e4c6063fa
SSDEEP 24576:Aiu/p3I70p9B0cNwD3yL4G0d2VkXMhYR0Vv/REdTGDt4VgOK:wCI9BtwD/QSMqYv/Ri4AgO
TLSH
T1E4450115F781C033D5A2107A9AA9C77E693A7A75072A54C3B7D82F75BF203D0AA3530E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

165775

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\956185\out\Release\

kernel32

CreateMutexA SetLastError GetCurrentThreadId DeleteCriticalSection FlushInstructionCache GetCurrentProcess EnterCriticalSection LeaveCriticalSection InterlockedIncrement InterlockedDecrement GetModuleHandleW lstrlenW InitializeCriticalSection FreeLibrary MultiByteToWideChar LoadLibraryExW lstrcmpiW GetProcAddress ReleaseMutex GetLastError GetCurrentProcessId OpenProcess TerminateProcess CreateToolhelp32Snapshot HeapWalk HeapLock OpenThread HeapUnlock OutputDebugStringW GetFileSizeEx SetFilePointerEx SetEndOfFile LocalFileTimeToFileTime SystemTimeToFileTime SetEnvironmentVariableA CompareStringW CompareStringA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetTimeZoneInformation GetLocaleInfoW Process32FirstW GetConsoleCP IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID Process32NextW CloseHandle InterlockedCompareExchange Sleep FindResourceExW LoadResource LockResource SizeofResource FindResourceW RaiseException GetDateFormatA GetTimeFormatA GetStringTypeW GetStringTypeA LCMapStringA InitializeCriticalSectionAndSpinCount InterlockedExchange SetConsoleCtrlHandler GetTickCount QueryPerformanceCounter GetStartupInfoA GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA GetStdHandle FatalAppExitA GetModuleFileNameW GetCommandLineW HeapCreate LCMapStringW GetCurrentThread TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP GetACP GetCPInfo RtlUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetSystemTimeAsFileTime ExitProcess GetStartupInfoW CreateThread ExitThread FreeResource GetVersionExW GetSystemWindowsDirectoryW lstrlenA lstrcmpiA lstrcmpA LocalFree GetConsoleMode HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap LoadLibraryA IsProcessorFeaturePresent VirtualFree VirtualAlloc CreateFileW SetFilePointer LoadLibraryW ReadFile DeviceIoControl WriteFile FlushFileBuffers GetTempPathW DeleteFileW OpenMutexW CreateMutexW WaitForSingleObject WideCharToMultiByte GetSystemDirectoryW CreateFileA

user32

GetActiveWindow DefWindowProcW FindWindowW SendMessageTimeoutW MessageBoxW UnregisterClassA DispatchMessageW TranslateMessage GetMessageW PeekMessageW DestroyWindow wsprintfW CreateDialogParamW GetParent GetWindow GetWindowRect GetWindowLongW MonitorFromWindow GetMonitorInfoW GetClientRect MapWindowPoints SetWindowPos IsDialogMessageW SendMessageW SetWindowTextW PostMessageW PostQuitMessage GetSystemMetrics LoadImageW CharNextW SetWindowLongW ShowWindow

advapi32

RegCreateKeyExW OpenProcessToken RegOpenKeyExA RegQueryValueExW RegQueryInfoKeyW RegSetValueExW RegEnumKeyExW RegOpenKeyExW GetTokenInformation RegCloseKey RegDeleteValueW RegDeleteKeyW RegEnumKeyExA RegQueryValueExA

shell32

ShellExecuteExW CommandLineToArgvW ShellExecuteW ord165

ole32

CoInitializeEx CoSetProxyBlanket CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree CoInitialize CoCreateGuid CoCreateInstance CoInitializeSecurity CoUninitialize

oleaut32

SysAllocString SysFreeString VarUI4FromStr VariantInit VariantClear

shlwapi

StrToIntExW SHGetValueA PathIsDirectoryW PathAppendW PathFileExistsW PathCombineW SHSetValueA StrTrimA StrCmpNIW StrStrIA PathRemoveExtensionW StrStrIW SHGetValueW SHDeleteValueW SHSetValueW StrCmpIW PathFindFileNameW

comctl32

InitCommonControlsEx

setupapi

SetupIterateCabinetW

wininet

InternetOpenW InternetCloseHandle InternetReadFile HttpOpenRequestW InternetConnectW HttpSendRequestW InternetQueryOptionW InternetSetOptionW HttpQueryInfoW InternetCrackUrlW

ws2_32

htons closesocket gethostbyname connect inet_ntoa send recv socket WSAStartup WSACleanup

version

VerQueryValueW

iphlpapi

GetAdaptersInfo

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_2cf6fdd45bd73fa9af115598189c9111_elex_rhadamanthys_stop

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

setupapi

wininet

ws2_32

version

iphlpapi

generic