General
- Target 2026-09-29_2b9feb7355eb10d3c4f16995ef065afd_elex_qilin_rhadamanthys
- Size 119KB
- Sample260930-edjeksvela
- SHA256 fa2c829190fcff574c0941b08033c6fa46e5ebe2bb121055daefd487146cd683
- MD5 2b9feb7355eb10d3c4f16995ef065afd
- SHA1 69ad3d572c7a2354d76ad1956e9e25a0f8f94c74
- SHA512 e17e5e2ae6ff01543c23424c1316f72c378d9a634c4b1343fdde2f02767af2de2ee7ca4e38d2a90ba0c888f9018a90c8d0895c8babb7b273107d446a2d3bb4d5
- SSDEEP 3072:NAoglOwvl4ulkP6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrh1hKw:eene
- TLSH T1ECC3F6075EB18CEBD840043A57FAA22D86EBBC440DECE356D7DDCC4634D2918C8AEA57
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-09-29_2b9feb7355eb10d3c4f16995ef065afd_elex_qilin_rhadamanthys.exe
Resource
win10v2004-20260911-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-29_2b9feb7355eb10d3c4f16995ef065afd_elex_qilin_rhadamanthys.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
blihanstealer
Mutex
-
pomdfghrt
Attributes
-
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; CIBA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Targets
-
- Target 2026-09-29_2b9feb7355eb10d3c4f16995ef065afd_elex_qilin_rhadamanthys
- Size 119KB
- SHA256 fa2c829190fcff574c0941b08033c6fa46e5ebe2bb121055daefd487146cd683
- MD5 2b9feb7355eb10d3c4f16995ef065afd
- SHA1 69ad3d572c7a2354d76ad1956e9e25a0f8f94c74
- SHA512 e17e5e2ae6ff01543c23424c1316f72c378d9a634c4b1343fdde2f02767af2de2ee7ca4e38d2a90ba0c888f9018a90c8d0895c8babb7b273107d446a2d3bb4d5
- SSDEEP 3072:NAoglOwvl4ulkP6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrh1hKw:eene
- TLSH T1ECC3F6075EB18CEBD840043A57FAA22D86EBBC440DECE356D7DDCC4634D2918C8AEA57
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects executables built or packed with MPress PE compressor
-
Deletes itself
-
Executes dropped EXE
-
Adds Run key to start application