cc3a8b3b58339980203961c4ce492b66c9311b9e2c63d3778117987c8a2a3f39

General

Target
2026-10-01_86dc590f5edc1c8ea1306cfa0f85c51b_elex_rhadamanthys_stop
Size 2.3MB
Sample261002-lvrwlsvbmc
SHA256 cc3a8b3b58339980203961c4ce492b66c9311b9e2c63d3778117987c8a2a3f39
MD5 86dc590f5edc1c8ea1306cfa0f85c51b
SHA1 ef515c9fc6d504be004b118cc605f6881a3704f9
SHA512 6077efb5d294cedf9d725b21c2dfc528ed7d0705fd178f7a1b2a782ae697450e6873b4507ca4a26d82e1b620e10717bc02f19acd220290e23ff9fa434b03fe49
SSDEEP 3072:2xh0oLKfdAkFDHj+nStkJOh+p3ZSNwG0qE/6GcX:Ah0XSOqnvohPa16
TLSH
T129B5CF0076D0FCBBE5B5467148B69B319B3AFD365B2ACC83B358564A0932184B7763CB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-01_86dc590f5edc1c8ea1306cfa0f85c51b_elex_rhadamanthys_stop
- Size 2.3MB
- SHA256 cc3a8b3b58339980203961c4ce492b66c9311b9e2c63d3778117987c8a2a3f39
- MD5 86dc590f5edc1c8ea1306cfa0f85c51b
- SHA1 ef515c9fc6d504be004b118cc605f6881a3704f9
- SHA512 6077efb5d294cedf9d725b21c2dfc528ed7d0705fd178f7a1b2a782ae697450e6873b4507ca4a26d82e1b620e10717bc02f19acd220290e23ff9fa434b03fe49
- SSDEEP 3072:2xh0oLKfdAkFDHj+nStkJOh+p3ZSNwG0qE/6GcX:Ah0XSOqnvohPa16
- TLSH
  T129B5CF0076D0FCBBE5B5467148B69B319B3AFD365B2ACC83B358564A0932184B7763CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

adware defense_evasion discovery execution persistence spyware stealer ransomware
- Detects Windows executables referencing non-Windows User-Agents
- Detects executables referencing many email and collaboration clients. Observed in information steale
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes a file named after a Windows system binary
  The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
  defense_evasion
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2