2026-09-30_c5eb0a6becbdfabe81438d88b8fe5f01_elex_rhadamanthys_stop

General

Target
2026-09-30_c5eb0a6becbdfabe81438d88b8fe5f01_elex_rhadamanthys_stop
Size 711KB
Sample260930-jtl8maxvhy
SHA256 d1f860d5d3caf1246e9f1724268084dfd7b34297d2f8891c594643b9790460e2
MD5 c5eb0a6becbdfabe81438d88b8fe5f01
SHA1 94702d75d3e846954d8840bd87f607ed8f0368d8
SHA512 5faafb5cf4f8eb04675fa7115d9c0c086071e5e53056775617cc3727721e28f6083b17e3b2ef4a2ea6ebd1ef43eb96be59a1ed0ac28053b8054a477c149d6a96
SSDEEP 12288:x/nENfn0QKKMsHKp0ETky9BLxfsSm+oIo7y1kwQZ0bxkWqPbsxTnxWy+:JENfntKK9HKpljBLxfpoxyCwS0bxvqzB
TLSH
T1AFF412013990D4B2C9FF19750C28C7A18B79F8612520DA37B7842BBE6EE35D09E35E1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_c5eb0a6becbdfabe81438d88b8fe5f01_elex_rhadamanthys_stop

File Explorer

2026-09-30_c5eb0a6becbdfabe81438d88b8fe5f01_elex_rhadamanthys_stop

.exe 711KB

2026-09-30_c5eb0a6becbdfabe81438d88b8fe5f01_elex_rhadamanthys_stop

IMPHASH 8a8349050dccf77dfddbf10f15c614d4
SHA256 d1f860d5d3caf1246e9f1724268084dfd7b34297d2f8891c594643b9790460e2
MD5 c5eb0a6becbdfabe81438d88b8fe5f01
SHA1 94702d75d3e846954d8840bd87f607ed8f0368d8
SHA512 5faafb5cf4f8eb04675fa7115d9c0c086071e5e53056775617cc3727721e28f6083b17e3b2ef4a2ea6ebd1ef43eb96be59a1ed0ac28053b8054a477c149d6a96
SSDEEP 12288:x/nENfn0QKKMsHKp0ETky9BLxfsSm+oIo7y1kwQZ0bxkWqPbsxTnxWy+:JENfntKK9HKpljBLxfpoxyCwS0bxvqzB
TLSH
T1AFF412013990D4B2C9FF19750C28C7A18B79F8612520DA37B7842BBE6EE35D09E35E1E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

11698

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ziki80\fejidu\guketopunuza-mey_xexox\pamakacita foracuxef.pdb

kernel32

GetLocaleInfoA LoadResource InterlockedIncrement ReadConsoleA GetSystemWindowsDirectoryW GetEnvironmentStringsW WaitForSingleObject FindActCtxSectionStringA GetUserDefaultLangID QueryActCtxW LeaveCriticalSection VerifyVersionInfoA WriteConsoleW ReleaseSemaphore GetProcAddress EnterCriticalSection DisableThreadLibraryCalls ResetEvent OpenMutexA LocalAlloc SetConsoleOutputCP GlobalGetAtomNameW WaitForMultipleObjects SetSystemTime GetModuleFileNameA GetModuleHandleA EraseTape FindFirstVolumeA GetCurrentProcessId AddConsoleAliasA GetModuleFileNameW GetCommandLineW GetLastError HeapReAlloc HeapAlloc GetStartupInfoW RaiseException RtlUnwind TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapFree SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection SetFilePointer GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId InterlockedDecrement HeapCreate VirtualFree VirtualAlloc CloseHandle Sleep ExitProcess WriteFile FreeEnvironmentStringsW QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime CreateFileA InitializeCriticalSectionAndSpinCount SetStdHandle GetCPInfo GetACP GetOEMCP IsValidCodePage WideCharToMultiByte GetConsoleCP GetConsoleMode FlushFileBuffers HeapSize LoadLibraryA SetEndOfFile GetProcessHeap MultiByteToWideChar ReadFile GetStringTypeA GetStringTypeW LCMapStringA LCMapStringW WriteConsoleA GetConsoleOutputCP

user32

RealChildWindowFromPoint

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_c5eb0a6becbdfabe81438d88b8fe5f01_elex_rhadamanthys_stop

kernel32

user32

generic