2026-10-02_71a97162a5c65e5d5639278c63533804_elex_rhadamanthys_stealc_stop_virut

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-02_71a97162a5c65e5d5639278c63533804_elex_rhadamanthys_stealc_stop_virut
Size 4.8MB
Sample261003-mc56yswemf
SHA256 f3db9c98daac6745d8a9add874c80bace0a6a3de819af8db8561f992ffd1522c
MD5 71a97162a5c65e5d5639278c63533804
SHA1 7a59acb8ce33a56df39e8f09f63a579233c40717
SHA512 631e79d3920385812ef11c7f79d074a9e41ff9df0fcb26cdabd509ab8ecb7f740c5ec92a4c6955a9f76ca3500e47e91019b00734ea3a274e3d0cd86d68322b6a
SSDEEP 24576:b4L1dN9IgGFCXy3DryDNYhJ7fdTazmaj9Tb9X9Pu3mmGld6oKZmMP+73l:kB3pyYqhJ7fdVa5TLG3mmhHmMP+bl
TLSH
T1EE362CBFD841B8E4C264317497468872334ADC69FA7B14B6DF2B7A10B8B5A32443F91D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-02_71a97162a5c65e5d5639278c63533804_elex_rhadamanthys_stealc_stop_virut

File Explorer

2026-10-02_71a97162a5c65e5d5639278c63533804_elex_rhadamanthys_stealc_stop_virut

.exe 4.8MB

2026-10-02_71a97162a5c65e5d5639278c63533804_elex_rhadamanthys_stealc_stop_virut

IMPHASH acfef535e8b5c72c202946df51365728
SHA256 f3db9c98daac6745d8a9add874c80bace0a6a3de819af8db8561f992ffd1522c
MD5 71a97162a5c65e5d5639278c63533804
SHA1 7a59acb8ce33a56df39e8f09f63a579233c40717
SHA512 631e79d3920385812ef11c7f79d074a9e41ff9df0fcb26cdabd509ab8ecb7f740c5ec92a4c6955a9f76ca3500e47e91019b00734ea3a274e3d0cd86d68322b6a
SSDEEP 24576:b4L1dN9IgGFCXy3DryDNYhJ7fdTazmaj9Tb9X9Pu3mmGld6oKZmMP+73l:kB3pyYqhJ7fdVa5TLG3mmhHmMP+bl
TLSH
T1EE362CBFD841B8E4C264317497468872334ADC69FA7B14B6DF2B7A10B8B5A32443F91D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

2c:27:0c:ad:dc:96:48:7e:da:fe:7f:b1:1f:4c:86:b2:e2:4e:db:8b:d3:e4:12:49:e0:7d:d6:e6:11:00:ea:44

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=911101026662879416,CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,STREET=朝阳区酒仙桥路6号院2号楼1至19层104号内8层801,L=Beijing,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074245494a494e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Apr 23, 2023

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

44:8a:bf:29:b0:45:82:3e:5d:6d:cc:0b

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 5, 2022 - Jan 6, 2024

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

Major OS version

Entry point

5329534

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\726357\out\Release\360Inst.pdb

shlwapi

SHGetValueA PathCombineA UrlCanonicalizeW UrlCanonicalizeA wvnsprintfW PathFindFileNameW StrStrIW SHGetValueW PathCombineW PathRemoveFileSpecW PathFileExistsW PathIsRootW PathIsDirectoryW PathAppendW SHSetValueA

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

kernel32

WriteFile LockResource SizeofResource LoadResource FindResourceW SetLastError GetFullPathNameW FindFirstFileW GetCurrentThreadId InterlockedIncrement DebugBreak OutputDebugStringW lstrlenA GetTempFileNameW GetTempPathW GetModuleFileNameW GetCommandLineW GetLastError GetTickCount GetExitCodeThread ResumeThread InitializeCriticalSection DeleteCriticalSection lstrcmpiW FreeLibrary MultiByteToWideChar LoadLibraryExW GetModuleHandleW MulDiv GetProcAddress GetVersionExW GetDiskFreeSpaceExW GlobalFree GlobalLock GlobalAlloc GetFileSizeEx GetPrivateProfileStringW GetPrivateProfileIntW GetFileAttributesExW GetExitCodeProcess TerminateProcess Module32FirstW GetSystemDirectoryW CopyFileW OpenProcess WideCharToMultiByte GlobalFindAtomW TlsSetValue TlsGetValue TlsAlloc SetEvent CreateThread CreateEventW GetFileType GetLongPathNameW GetDriveTypeW InterlockedCompareExchange CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoA GetStringTypeW FlushFileBuffers GetCurrentDirectoryA PeekNamedPipe GetFileInformationByHandle LCMapStringW LCMapStringA GetStartupInfoA SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW InitializeCriticalSectionAndSpinCount GetModuleFileNameA GetStdHandle GetConsoleMode GetConsoleCP HeapSize HeapCreate IsValidCodePage GetOEMCP GetACP GetCPInfo FileTimeToLocalFileTime FileTimeToSystemTime HeapReAlloc GetStartupInfoW ExitProcess IsDebuggerPresent UnhandledExceptionFilter ExitThread RtlUnwind lstrcmpiA lstrcmpA GetSystemDirectoryA GetModuleHandleA QueryPerformanceFrequency QueryPerformanceCounter ResetEvent GetUserDefaultLangID MoveFileW InterlockedExchangeAdd FreeLibraryAndExitThread GetModuleHandleExW CreateWaitableTimerW SetWaitableTimer CreateSemaphoreW WaitForMultipleObjects ReleaseSemaphore TlsFree HeapWalk HeapLock OpenThread HeapUnlock SetFilePointerEx SetEndOfFile LocalFileTimeToFileTime GetSystemTimeAsFileTime SystemTimeToFileTime VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA HeapAlloc GetProcessHeap HeapFree SetUnhandledExceptionFilter Sleep GlobalUnlock SetErrorMode FreeResource RaiseException InterlockedExchange MoveFileExW CreateMutexW WaitForSingleObject GetLocalTime ReleaseMutex DeleteFileW ReadFile SetFilePointer GetCurrentProcessId DeviceIoControl LoadLibraryW FindClose FindNextFileW InterlockedDecrement GetCurrentProcess FlushInstructionCache lstrlenW lstrcpyW CreateToolhelp32Snapshot Process32FirstW Process32NextW RemoveDirectoryW EnterCriticalSection LeaveCriticalSection CreateDirectoryW GetFileAttributesW CreateFileW GetFileSize SetEnvironmentVariableA CloseHandle GetTimeZoneInformation GetDriveTypeA CompareStringA CompareStringW GetStringTypeA

user32

DispatchMessageW TranslateMessage GetMessageW PeekMessageW SetForegroundWindow CharLowerW SetWindowLongW DialogBoxParamW GetActiveWindow DestroyWindow DefWindowProcW DrawStateW CallWindowProcW GetClientRect InvalidateRect IsWindowEnabled wvsprintfW PostMessageW MessageBoxW PtInRect OffsetRect SetCursor LoadCursorW GetWindowTextW GetDC ReleaseDC GetWindowLongW UnregisterClassA UnregisterClassW wsprintfW GetDlgCtrlID GetDesktopWindow GetFocus EndDialog CreateWindowExW SetWindowTextW InflateRect SetScrollInfo LoadStringW ShowWindow CopyRect SendMessageW CallNextHookEx UnhookWindowsHookEx CheckDlgButton SetWindowsHookExW IsDlgButtonChecked GetDlgItemTextW CreateDialogParamW GetClassNameW CharNextW ShowScrollBar SetScrollPos GetScrollRange GetScrollPos SetFocus GetScrollInfo GetCursorPos GetSystemMenu DestroyMenu EnableMenuItem FindWindowExW LoadIconW PostQuitMessage IsDialogMessageW UpdateWindow GetWindowPlacement BringWindowToTop KillTimer RegisterClassExW EnableWindow GetClassInfoExW IsIconic ExitWindowsEx GetSysColor SetDlgItemTextW SetTimer CharUpperW GetSystemMetrics LoadImageW MoveWindow EndPaint BeginPaint DrawTextW LoadBitmapW GetWindow MonitorFromWindow GetMonitorInfoW MapWindowPoints IsWindow SetWindowRgn GetDlgItem GetParent RedrawWindow IsWindowVisible ScreenToClient GetWindowRect SetWindowPos

gdi32

GetDeviceCaps GetBitmapBits SetBitmapBits CreateRectRgn ExtSelectClipRgn CreateFontIndirectW CreateRoundRectRgn CreateFontW GetObjectW SetBkMode CreateCompatibleBitmap BitBlt SelectObject CreateCompatibleDC GetTextExtentPoint32W RestoreDC SaveDC DeleteDC DeleteObject SetTextColor CreateSolidBrush

advapi32

RegOpenKeyExW RegSetValueExA RegDeleteKeyW RegQueryValueExA RegQueryValueExW RegOpenKeyW RegNotifyChangeKeyValue RegCreateKeyExA RegEnumKeyExA OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW RegCreateKeyExW RegCloseKey RegDeleteValueW RegOpenKeyExA

shell32

SHGetSpecialFolderPathW SHBrowseForFolderW Shell_NotifyIconW ShellExecuteExW SHGetSpecialFolderLocation SHGetPathFromIDListW ShellExecuteW SHCreateDirectoryExW

ole32

CoCreateInstance OleRun CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoUninitialize CoInitialize CreateStreamOnHGlobal CLSIDFromProgID

oleaut32

VariantChangeType GetErrorInfo SafeArrayDestroy SafeArrayPutElement SafeArrayCreate SysFreeString OleLoadPicture VarUI4FromStr SysAllocString VariantClear VariantInit

comctl32

_TrackMouseEvent InitCommonControlsEx

msimg32

AlphaBlend TransparentBlt

ws2_32

accept WSAAsyncSelect WSACancelAsyncRequest __WSAFDIsSet ioctlsocket listen shutdown getpeername WSASetLastError sendto recvfrom bind WSAGetLastError WSCEnumProtocols ntohs htonl ntohl select gethostname WSAAsyncGetHostByName inet_ntoa socket htons connect closesocket setsockopt send recv gethostbyname inet_addr WSAStartup WSACleanup

setupapi

SetupIterateCabinetW

wininet

InternetConnectW HttpOpenRequestW HttpSendRequestW InternetOpenUrlW InternetCloseHandle HttpQueryInfoW InternetErrorDlg InternetOpenW

psapi

EnumProcessModules GetModuleFileNameExW

iphlpapi

GetNetworkParams GetAdaptersInfo

secur32

InitializeSecurityContextA FreeCredentialsHandle AcquireCredentialsHandleA

rasapi32

RasEnumConnectionsW RasGetConnectStatusW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-02_71a97162a5c65e5d5639278c63533804_elex_rhadamanthys_stealc_stop_virut

PE Signature issue

shlwapi

version

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

msimg32

ws2_32

setupapi

wininet

psapi

iphlpapi

secur32

rasapi32

generic