General
- Target 2026-10-14_add7a5d9f727669ee03ed2d70bbc9a24_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 290KB
- Sample261014-rtb2nage82
- SHA256 a3925603efd3f271d88c1a2806a6927122f3df761de6103772aeba92e2f73501
- MD5 add7a5d9f727669ee03ed2d70bbc9a24
- SHA1 1ecddc4d4fcfe5f865d34147e01737ae12dae94f
- SHA512 37fbba7ac5b5d309e555d1c89c57d88437439c3a9e093223aa7cac8cf185e3554df8d019e1659a39e55edf488c46408c0e775bdab2b41c01762e46b88401ebe8
- SSDEEP 3072:NAoglOwvl4ulkP6vghzwYu7vih9GueIh9j2IoHAjUvJQ/johleHhvGhZchUXahNI:een/WDKW1Lgbdl0TBBvjc/oVM6
- TLSH T18D54AF1275C1C1B3C466003145E6CB3D9A7F78210BB9D6D7BBDCDA6A2E513D0E63A2CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-10-14_add7a5d9f727669ee03ed2d70bbc9a24_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260911-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-14_add7a5d9f727669ee03ed2d70bbc9a24_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
blihanstealer
Mutex
-
pomdfghrt
Attributes
-
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; CIBA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Targets
-
- Target 2026-10-14_add7a5d9f727669ee03ed2d70bbc9a24_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 290KB
- SHA256 a3925603efd3f271d88c1a2806a6927122f3df761de6103772aeba92e2f73501
- MD5 add7a5d9f727669ee03ed2d70bbc9a24
- SHA1 1ecddc4d4fcfe5f865d34147e01737ae12dae94f
- SHA512 37fbba7ac5b5d309e555d1c89c57d88437439c3a9e093223aa7cac8cf185e3554df8d019e1659a39e55edf488c46408c0e775bdab2b41c01762e46b88401ebe8
- SSDEEP 3072:NAoglOwvl4ulkP6vghzwYu7vih9GueIh9j2IoHAjUvJQ/johleHhvGhZchUXahNI:een/WDKW1Lgbdl0TBBvjc/oVM6
- TLSH T18D54AF1275C1C1B3C466003145E6CB3D9A7F78210BB9D6D7BBDCDA6A2E513D0E63A2CA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects executables built or packed with MPress PE compressor
-
Deletes itself
-
Executes dropped EXE
-
Adds Run key to start application