2026-10-15_f31112c7999614bf02ce974c02584de7_elex_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-15_f31112c7999614bf02ce974c02584de7_elex_rhadamanthys_stop
Size 1.4MB
Sample261015-24qb5sef49
SHA256 167ba5be46833ff29064a2fe8989117aa550041c16c247aea04a3c097d1e2a21
MD5 f31112c7999614bf02ce974c02584de7
SHA1 4be03bd49479d64dd390302e62f73a876efd389c
SHA512 f0bc9fe913f171518a8dd1f931dc5ec97893c858659509efeaf0231fc1f77fb439d0327b54f5c6a2659711c9687986dd577f4a997d17f7ca4686e93188ffb3dc
SSDEEP 24576:us4oJfdc2sqjnhMgeiCl7G0nehbGZpbD:uLoJfddDmg27RnWGj
TLSH
T19665011137D1C4B7F56301BB4566C32DAA3778A2AF2185CB6BC11DAEEA706D09F36321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-15_f31112c7999614bf02ce974c02584de7_elex_rhadamanthys_stop

File Explorer

2026-10-15_f31112c7999614bf02ce974c02584de7_elex_rhadamanthys_stop

.exe 1.4MB

2026-10-15_f31112c7999614bf02ce974c02584de7_elex_rhadamanthys_stop

IMPHASH 02609d87f0e1df10fbbcaef5ad2d62d4
SHA256 167ba5be46833ff29064a2fe8989117aa550041c16c247aea04a3c097d1e2a21
MD5 f31112c7999614bf02ce974c02584de7
SHA1 4be03bd49479d64dd390302e62f73a876efd389c
SHA512 f0bc9fe913f171518a8dd1f931dc5ec97893c858659509efeaf0231fc1f77fb439d0327b54f5c6a2659711c9687986dd577f4a997d17f7ca4686e93188ffb3dc
SSDEEP 24576:us4oJfdc2sqjnhMgeiCl7G0nehbGZpbD:uLoJfddDmg27RnWGj
TLSH
T19665011137D1C4B7F56301BB4566C32DAA3778A2AF2185CB6BC11DAEEA706D09F36321
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

56805

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\SVNRepository\EpsonScan_Externals\ESCSVC_trunk\Release\EscSvc.pdb

setupapi

SetupDiOpenDeviceInfoW SetupDiCreateDeviceInfoList SetupDiGetClassDevsW CM_Get_Device_ID_Size CM_Get_Parent CM_Get_Sibling CM_Get_Child CM_Locate_DevNodeW SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyW SetupDiGetDeviceInstanceIdW SetupDiEnumDeviceInfo CM_Get_Device_IDW

kernel32

lstrcmpiW OpenProcess lstrcmpW GetPrivateProfileStringW CompareStringW GetLocalTime GetFileAttributesExW OutputDebugStringW GetCurrentProcessId GetCurrentThreadId GetPrivateProfileIntW LoadLibraryW GetProcAddress GetCurrentProcess lstrcpynW CreateProcessW GetExitCodeProcess WTSGetActiveConsoleSessionId CreateToolhelp32Snapshot Process32FirstW Process32NextW WriteConsoleA GetTimeZoneInformation FlushFileBuffers SetStdHandle CreateFileW LoadLibraryA GetTickCount FindResourceW CreateMutexW GetModuleFileNameW SetEvent GetLastError CloseHandle LocalFree WaitForSingleObject CreateEventW GetCommandLineW ReleaseMutex FindResourceExW LoadResource LockResource lstrlenW SizeofResource Sleep FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetSystemTimeAsFileTime GetConsoleOutputCP GetStringTypeA GetStringTypeW GetTimeFormatA GetDateFormatA GetUserDefaultLCID FreeLibrary GetEnvironmentStrings InterlockedExchange SetConsoleCtrlHandler SetEnvironmentVariableA GetConsoleMode CompareStringA CreateFileA ReadFile FreeEnvironmentStringsA GetModuleFileNameA GetStdHandle GetConsoleCP SetFilePointer IsValidLocale EnumSystemLocalesA WriteFile HeapCreate VirtualAlloc VirtualFree SetEndOfFile GetLocaleInfoW WriteConsoleW RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetVersionExA HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW RtlUnwind GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThread MultiByteToWideChar LCMapStringA WideCharToMultiByte LCMapStringW ExitProcess FatalAppExitA GetLocaleInfoA

user32

PostMessageW FindWindowW RegisterWindowMessageW UnregisterDeviceNotification RegisterDeviceNotificationW UnregisterClassA

advapi32

CreateProcessAsUserW RegDeleteKeyW RegDeleteValueW RegSetValueExW RegCreateKeyExW RegQueryValueExW SetTokenInformation DuplicateTokenEx OpenProcessToken FreeSid SetNamedSecurityInfoW SetEntriesInAclW AllocateAndInitializeSid GetNamedSecurityInfoW RegEnumValueW RegCloseKey RegEnumKeyExW RegOpenKeyExW QueryServiceStatusEx InitializeSecurityDescriptor StartServiceW SetSecurityDescriptorDacl OpenServiceW CloseServiceHandle CreateServiceW OpenSCManagerW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW DeleteService QueryServiceStatus ControlService

shell32

SHGetFolderPathW CommandLineToArgvW

ole32

CoUninitialize CoCreateInstance FreePropVariantArray CoInitialize

oleaut32

SysFreeString SysAllocString

shlwapi

PathAppendW PathQuoteSpacesW PathRemoveBlanksW

psapi

EnumProcesses EnumProcessModules GetModuleBaseNameW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-15_f31112c7999614bf02ce974c02584de7_elex_rhadamanthys_stop

setupapi

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

psapi

userenv

generic