General
- Target 2026-10-07_1e30eded7376300621ab5cfcd2cf0c11_elex_qilin_rhadamanthys
- Size 127KB
- Sample261007-svcj9aaz6y
- SHA256 d4e191aefc8934f538692e8efbe0d59d7c6d74ac1cb6770c16da5237b76186e4
- MD5 1e30eded7376300621ab5cfcd2cf0c11
- SHA1 e40b127e13e65324db9c0ba3d89845e3330cd36d
- SHA512 02617c413c39ecb14c1693fe0a1072bd2a4334d149214efd931a59efa088c8739709e87aeb078b5a9bdb5f282af0e69a9c9e08992eba017546c8d9703dcd6b36
- SSDEEP 3072:NAoglOwvl4ulkP6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrh1hKv:eenet
- TLSH T153D3D6075EA1CCEBD801003A57FAA22D86EBFD440DECE35697DDCC4634D2918C8AEA57
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-10-07_1e30eded7376300621ab5cfcd2cf0c11_elex_qilin_rhadamanthys.exe
Resource
win10v2004-20260911-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-07_1e30eded7376300621ab5cfcd2cf0c11_elex_qilin_rhadamanthys.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
blihanstealer
Mutex
-
pomdfghrt
Attributes
-
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; CIBA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Targets
-
- Target 2026-10-07_1e30eded7376300621ab5cfcd2cf0c11_elex_qilin_rhadamanthys
- Size 127KB
- SHA256 d4e191aefc8934f538692e8efbe0d59d7c6d74ac1cb6770c16da5237b76186e4
- MD5 1e30eded7376300621ab5cfcd2cf0c11
- SHA1 e40b127e13e65324db9c0ba3d89845e3330cd36d
- SHA512 02617c413c39ecb14c1693fe0a1072bd2a4334d149214efd931a59efa088c8739709e87aeb078b5a9bdb5f282af0e69a9c9e08992eba017546c8d9703dcd6b36
- SSDEEP 3072:NAoglOwvl4ulkP6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrh1hKv:eenet
- TLSH T153D3D6075EA1CCEBD801003A57FAA22D86EBFD440DECE35697DDCC4634D2918C8AEA57
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects executables built or packed with MPress PE compressor
-
Deletes itself
-
Executes dropped EXE
-
Adds Run key to start application