stormser | 2026-10-01_281a8b02cbe3d763546bb46a6db062dc_elex_qilin_rhadamanthys_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_281a8b02cbe3d763546bb46a6db062dc_elex_qilin_rhadamanthys_wannacry
Size 382KB
Sample261003-1b52fsff62
SHA256 e827069ef10fcd270d362b50a53bf5ec692599b1a774e307872eba10e5329ef8
MD5 281a8b02cbe3d763546bb46a6db062dc
SHA1 acba3c27ad9353039966cf66daf3f47ea4794562
SHA512 e98e1795bc410a5d0845772d04cf9d0bf307c17c2197e0826b2420564ee4944aaed00ad460942de9f8584a2733136370e4e64179a2aa15636eb924cbc2a52d8d
SSDEEP 6144:Y9nXgeM7iNEkgiOb31kiEC3J+d9nutEGOlJ:Ytge3jgR1qC3YdQt
TLSH
T15A847C12AE94C4F3E85300B20694A77D9A77FC34199DDA43D3D9DE7928E0610CA9D3AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

worm stormser trojan stealer blihanstealer downloader snojan

Malware Config

Extracted

Family

blihanstealer

Mutex

pomdfghrt

Attributes

user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; CIBA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Signatures

Family: BlihanStealer
Blihan is a stealer written in C++.
trojan stealer blihanstealer
Family: Snojan
Snojan is a downloader used to drop and execute other malware.
downloader snojan
Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 1 IoCs

resource	yara_rule
sample	family_stormser

Detects executables built or packed with MPress PE compressor 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_MPress

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_281a8b02cbe3d763546bb46a6db062dc_elex_qilin_rhadamanthys_wannacry

File Explorer

2026-10-01_281a8b02cbe3d763546bb46a6db062dc_elex_qilin_rhadamanthys_wannacry

.exe 382KB

2026-10-01_281a8b02cbe3d763546bb46a6db062dc_elex_qilin_rhadamanthys_wannacry

SHA256 e827069ef10fcd270d362b50a53bf5ec692599b1a774e307872eba10e5329ef8
MD5 281a8b02cbe3d763546bb46a6db062dc
SHA1 acba3c27ad9353039966cf66daf3f47ea4794562
SHA512 e98e1795bc410a5d0845772d04cf9d0bf307c17c2197e0826b2420564ee4944aaed00ad460942de9f8584a2733136370e4e64179a2aa15636eb924cbc2a52d8d
SSDEEP 6144:Y9nXgeM7iNEkgiOb31kiEC3J+d9nutEGOlJ:Ytge3jgR1qC3YdQt
TLSH
T15A847C12AE94C4F3E85300B20694A77D9A77FC34199DDA43D3D9DE7928E0610CA9D3AF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Stormser aka Storm DDoS and StormAttack
Detects executables built or packed with MPress PE compressor
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths