General
- Target 2026-10-22_a12e4ddc98804b91f3a2032ac991ef99_elex_qilin_rhadamanthys
- Size 126KB
- Sample261024-cxy82ahs8n
- SHA256 0811426c64e6b13c95223bcfaa1bfd9221b1fbb6d1f955d62e4c2df25e00c0bd
- MD5 a12e4ddc98804b91f3a2032ac991ef99
- SHA1 2839be707772f49a231a714046449ab9208e209f
- SHA512 efac67478c76cb47101daaa93ebecb89871787754e9864c071f19a7043ccd03b9ff4088f3f45d6fd361cad537535c33b7639f6a537c248ebe3bab199a13e7b00
- SSDEEP 3072:NAoglOwvl4ulkP6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrh1hKE:eene
- TLSH T171C3E60B5EB1CCEBD841043A57FAA22D86E7BC440DDCE35697DDCC4634D2918C8AEA57
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-10-22_a12e4ddc98804b91f3a2032ac991ef99_elex_qilin_rhadamanthys.exe
Resource
win10v2004-20260911-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_a12e4ddc98804b91f3a2032ac991ef99_elex_qilin_rhadamanthys.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
blihanstealer
Mutex
-
pomdfghrt
Attributes
-
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; CIBA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Targets
-
- Target 2026-10-22_a12e4ddc98804b91f3a2032ac991ef99_elex_qilin_rhadamanthys
- Size 126KB
- SHA256 0811426c64e6b13c95223bcfaa1bfd9221b1fbb6d1f955d62e4c2df25e00c0bd
- MD5 a12e4ddc98804b91f3a2032ac991ef99
- SHA1 2839be707772f49a231a714046449ab9208e209f
- SHA512 efac67478c76cb47101daaa93ebecb89871787754e9864c071f19a7043ccd03b9ff4088f3f45d6fd361cad537535c33b7639f6a537c248ebe3bab199a13e7b00
- SSDEEP 3072:NAoglOwvl4ulkP6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrh1hKE:eene
- TLSH T171C3E60B5EB1CCEBD841043A57FAA22D86E7BC440DDCE35697DDCC4634D2918C8AEA57
- MD5 SHA1 SHA512 SSDEEP TLSH
- Custom signature
Detects executables built or packed with MPress PE compressor
Deletes itself
Executes dropped EXE
Adds Run key to start application