General
- Target 2026-10-15_f19f8e5ed904aa3c2c851c3fa7912cb9_elex_qilin_rhadamanthys
- Size 128KB
- Sample261015-3cam2stvft
- SHA256 e80045516640319e538ee54f10357658366020608aeb7ede25b9c3ce37848e65
- MD5 f19f8e5ed904aa3c2c851c3fa7912cb9
- SHA1 720a2eb0ee19267d6154813a2b94f61d4d852679
- SHA512 3718f26edecbe258d1d53609d39082fedacad43efb3f9ad89711bee0fa5921fa7d5975007a08b354fd99fc4c4e25bb0a614f37a637a153bdbd938cb9fc0a6c08
- SSDEEP 3072:lAo1lOwvlKlXBP6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrh1hKj:W9nu
- TLSH T1D9D3E6075FA1CCEBD850043A57FAA22D86EBBC440DECE35687DDCC4634D2918C9AEA57
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-10-15_f19f8e5ed904aa3c2c851c3fa7912cb9_elex_qilin_rhadamanthys.exe
Resource
win10v2004-20260911-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-15_f19f8e5ed904aa3c2c851c3fa7912cb9_elex_qilin_rhadamanthys.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
blihanstealer
Mutex
-
pomdfghrt
Attributes
-
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; CIBA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Targets
-
- Target 2026-10-15_f19f8e5ed904aa3c2c851c3fa7912cb9_elex_qilin_rhadamanthys
- Size 128KB
- SHA256 e80045516640319e538ee54f10357658366020608aeb7ede25b9c3ce37848e65
- MD5 f19f8e5ed904aa3c2c851c3fa7912cb9
- SHA1 720a2eb0ee19267d6154813a2b94f61d4d852679
- SHA512 3718f26edecbe258d1d53609d39082fedacad43efb3f9ad89711bee0fa5921fa7d5975007a08b354fd99fc4c4e25bb0a614f37a637a153bdbd938cb9fc0a6c08
- SSDEEP 3072:lAo1lOwvlKlXBP6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrh1hKj:W9nu
- TLSH T1D9D3E6075FA1CCEBD850043A57FAA22D86EBBC440DECE35687DDCC4634D2918C9AEA57
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects executables built or packed with MPress PE compressor
-
Deletes itself
-
Executes dropped EXE
-
Adds Run key to start application