General
- Target 2026-10-22_5fa14931cca4b9e1fa1407e34a32d3ae_elex_qilin_rhadamanthys
- Size 129KB
- Sample261024-nndrhseh37
- SHA256 c419cff63cbe44b2b56c106eb8a804d9c0da385a3917e432c1f6dc177c75f1b4
- MD5 5fa14931cca4b9e1fa1407e34a32d3ae
- SHA1 40c54bf4a841decc27c7bba3e1bf3618ca9286d0
- SHA512 2d7ec6d627e7a736aad91c1c6f4c384bb99277d6d0b2af6b856eb6db7dd832ad649dc970cd5ddbcf37755f577cac61e05ba513e878be3bdceb09bbaca3cf32ae
- SSDEEP 3072:NAoglOwvl4ulkP6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrh1hKc:eene
- TLSH T1BBD3D50B5FA1CCEBD840043A57BAA22D86E7BC441DDCE35687EDCC4634D2918C8AEA57
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-10-22_5fa14931cca4b9e1fa1407e34a32d3ae_elex_qilin_rhadamanthys.exe
Resource
win10v2004-20260911-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_5fa14931cca4b9e1fa1407e34a32d3ae_elex_qilin_rhadamanthys.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
blihanstealer
Mutex
-
pomdfghrt
Attributes
-
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; CIBA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Targets
-
- Target 2026-10-22_5fa14931cca4b9e1fa1407e34a32d3ae_elex_qilin_rhadamanthys
- Size 129KB
- SHA256 c419cff63cbe44b2b56c106eb8a804d9c0da385a3917e432c1f6dc177c75f1b4
- MD5 5fa14931cca4b9e1fa1407e34a32d3ae
- SHA1 40c54bf4a841decc27c7bba3e1bf3618ca9286d0
- SHA512 2d7ec6d627e7a736aad91c1c6f4c384bb99277d6d0b2af6b856eb6db7dd832ad649dc970cd5ddbcf37755f577cac61e05ba513e878be3bdceb09bbaca3cf32ae
- SSDEEP 3072:NAoglOwvl4ulkP6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrh1hKc:eene
- TLSH T1BBD3D50B5FA1CCEBD840043A57BAA22D86E7BC441DDCE35687EDCC4634D2918C8AEA57
- MD5 SHA1 SHA512 SSDEEP TLSH
- Custom signature
Detects executables built or packed with MPress PE compressor
Deletes itself
Executes dropped EXE
Adds Run key to start application