General
- Target 2026-10-22_deaa05e4a8997badfda81b7100a8a735_elex_qilin_rhadamanthys
- Size 125KB
- Sample261023-vb2fday1as
- SHA256 2b946c2f858c5ad2970ba438b708295c29fd56f55ec64c19df756f4d3335d100
- MD5 deaa05e4a8997badfda81b7100a8a735
- SHA1 81d097ff5993ae108e644bcac3f980e24c1e3bec
- SHA512 30214c5da764147d671de7dff37e921ed9d6631045d3017dba79a52c3e3ea704501c05e5ffac35a18a6b2a5d5826e1f0be9e923c41cbba8fa33ed445abb91682
- SSDEEP 3072:lAo1lOwvlKlXBP6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrh1hKY:W9nut
- TLSH T1ACC3E60B5EB1C8DBD810043A57FAA22D86EBBD440DECE35797DDCC4634D2918C8AEA57
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-10-22_deaa05e4a8997badfda81b7100a8a735_elex_qilin_rhadamanthys.exe
Resource
win10v2004-20260911-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_deaa05e4a8997badfda81b7100a8a735_elex_qilin_rhadamanthys.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
blihanstealer
Mutex
-
pomdfghrt
Attributes
-
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; CIBA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Targets
-
- Target 2026-10-22_deaa05e4a8997badfda81b7100a8a735_elex_qilin_rhadamanthys
- Size 125KB
- SHA256 2b946c2f858c5ad2970ba438b708295c29fd56f55ec64c19df756f4d3335d100
- MD5 deaa05e4a8997badfda81b7100a8a735
- SHA1 81d097ff5993ae108e644bcac3f980e24c1e3bec
- SHA512 30214c5da764147d671de7dff37e921ed9d6631045d3017dba79a52c3e3ea704501c05e5ffac35a18a6b2a5d5826e1f0be9e923c41cbba8fa33ed445abb91682
- SSDEEP 3072:lAo1lOwvlKlXBP6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrh1hKY:W9nut
- TLSH T1ACC3E60B5EB1C8DBD810043A57FAA22D86EBBD440DECE35797DDCC4634D2918C8AEA57
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects executables built or packed with MPress PE compressor
-
Deletes itself
-
Executes dropped EXE
-
Adds Run key to start application