General
- Target 2026-10-06_9b304fe7fae2d6a3709a26726d4fad50_elex_mafia_rhadamanthys_stealc_stop_tofsee
- Size 500KB
- Sample261007-2q313sxx9p
- SHA256 8fc212233c257c9d1a8426349cca720207509e7961c63cf11c13dd99509ec843
- MD5 9b304fe7fae2d6a3709a26726d4fad50
- SHA1 480da321108633f534de63cddc9c4f6dc9799d2a
- SHA512 ed8f84b2b75547011ad19ca409103b2c73aa7e1e7158fbe2962096e0c730337f5d3b34734daedfc218386f83976fab522bf8c59721922dfa940b0efd1f82d26d
- SSDEEP 12288:5bEqkIX9IoqwhJmWYUXBDcLP7jGKk1XKdsKFWm:5bRk++whzBIP7jCJm
- TLSH T1B1B4DF3A245C80F7D22616B489C2A2F3F7ACB8A1552C557727CB4E3B1E20395B717E1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-10-06_9b304fe7fae2d6a3709a26726d4fad50_elex_mafia_rhadamanthys_stealc_stop_tofsee.exe
Resource
win10v2004-20260911-en
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-06_9b304fe7fae2d6a3709a26726d4fad50_elex_mafia_rhadamanthys_stealc_stop_tofsee.exe
Resource
win11ltsc2024-20260911-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-06_9b304fe7fae2d6a3709a26726d4fad50_elex_mafia_rhadamanthys_stealc_stop_tofsee
- Size 500KB
- SHA256 8fc212233c257c9d1a8426349cca720207509e7961c63cf11c13dd99509ec843
- MD5 9b304fe7fae2d6a3709a26726d4fad50
- SHA1 480da321108633f534de63cddc9c4f6dc9799d2a
- SHA512 ed8f84b2b75547011ad19ca409103b2c73aa7e1e7158fbe2962096e0c730337f5d3b34734daedfc218386f83976fab522bf8c59721922dfa940b0efd1f82d26d
- SSDEEP 12288:5bEqkIX9IoqwhJmWYUXBDcLP7jGKk1XKdsKFWm:5bRk++whzBIP7jCJm
- TLSH T1B1B4DF3A245C80F7D22616B489C2A2F3F7ACB8A1552C557727CB4E3B1E20395B717E1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Drops desktop.ini file(s)
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
1