stormser | 2026-09-30_950785a80d38fa87d657d08f950ec7da_elex_qilin_rhadamanthys_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-30_950785a80d38fa87d657d08f950ec7da_elex_qilin_rhadamanthys_wannacry
Size 382KB
Sample260930-lfn66sweja
SHA256 5ad1fc50c1462e1daaf50cf97a565c89cf4a2f1c0fc3a103775a86f098ec7322
MD5 950785a80d38fa87d657d08f950ec7da
SHA1 7a03e2df2385c438c4fa6408796567efcd74dd97
SHA512 99d4c939085ecf44f53ed6d6ed6e3d753d986b5c27a824ad68a1ab64cb731f230bdd37b8238294b4c309d1e2e25396f09f5214db98341736cc27d1e377f09f36
SSDEEP 6144:Y9nXgeM7iNEkgiOb31kiEC3J+d9nutEGOlJ:Ytge3jgR1qC3YdQt
TLSH
T1C8847C12AE94C4F3E85300B20694A77D9A77FC34199DDA43D3D9DE7928E0600CA9D3AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

worm stormser trojan stealer blihanstealer downloader snojan

Malware Config

Extracted

Family

blihanstealer

Mutex

pomdfghrt

Attributes

user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; CIBA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Signatures

Family: BlihanStealer
Blihan is a stealer written in C++.
trojan stealer blihanstealer
Family: Snojan
Snojan is a downloader used to drop and execute other malware.
downloader snojan
Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 1 IoCs

resource	yara_rule
sample	family_stormser

Detects executables built or packed with MPress PE compressor 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_MPress

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_950785a80d38fa87d657d08f950ec7da_elex_qilin_rhadamanthys_wannacry

File Explorer

2026-09-30_950785a80d38fa87d657d08f950ec7da_elex_qilin_rhadamanthys_wannacry

.exe 382KB

2026-09-30_950785a80d38fa87d657d08f950ec7da_elex_qilin_rhadamanthys_wannacry

SHA256 5ad1fc50c1462e1daaf50cf97a565c89cf4a2f1c0fc3a103775a86f098ec7322
MD5 950785a80d38fa87d657d08f950ec7da
SHA1 7a03e2df2385c438c4fa6408796567efcd74dd97
SHA512 99d4c939085ecf44f53ed6d6ed6e3d753d986b5c27a824ad68a1ab64cb731f230bdd37b8238294b4c309d1e2e25396f09f5214db98341736cc27d1e377f09f36
SSDEEP 6144:Y9nXgeM7iNEkgiOb31kiEC3J+d9nutEGOlJ:Ytge3jgR1qC3YdQt
TLSH
T1C8847C12AE94C4F3E85300B20694A77D9A77FC34199DDA43D3D9DE7928E0600CA9D3AF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Stormser aka Storm DDoS and StormAttack
Detects executables built or packed with MPress PE compressor
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths