General
- Target 2026-10-28_9a5f4661b9c3864bebd6bbc807ecdd3d_elex_qilin_rhadamanthys
- Size 126KB
- Sample261029-2tj3datvgx
- SHA256 398d4454dcdf8de5efc395cd87d35267b2597f8a60864675e2b9e535274af6b1
- MD5 9a5f4661b9c3864bebd6bbc807ecdd3d
- SHA1 b33e1069a170e6ef6e55903913fc5f81d179fc6c
- SHA512 9a5fd424ea4f11a465a9421276baf02df1000e382fe58e6b3989272820a9b6b1a7bc2f101680067836fdee7ed9688c233a1b0b979367614d84783db3e14d21f2
- SSDEEP 3072:NAoglOwvl4ulkP6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrh1hKM:eene
- TLSH T1B2C3E60B5FB1CCEBD841043A57BAA22D86E7BC440DDCE35687DDCC4634D2918C8AEA57
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-10-28_9a5f4661b9c3864bebd6bbc807ecdd3d_elex_qilin_rhadamanthys.exe
Resource
win10v2004-20260911-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-28_9a5f4661b9c3864bebd6bbc807ecdd3d_elex_qilin_rhadamanthys.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
blihanstealer
Mutex
-
pomdfghrt
Attributes
-
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; CIBA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Targets
-
- Target 2026-10-28_9a5f4661b9c3864bebd6bbc807ecdd3d_elex_qilin_rhadamanthys
- Size 126KB
- SHA256 398d4454dcdf8de5efc395cd87d35267b2597f8a60864675e2b9e535274af6b1
- MD5 9a5f4661b9c3864bebd6bbc807ecdd3d
- SHA1 b33e1069a170e6ef6e55903913fc5f81d179fc6c
- SHA512 9a5fd424ea4f11a465a9421276baf02df1000e382fe58e6b3989272820a9b6b1a7bc2f101680067836fdee7ed9688c233a1b0b979367614d84783db3e14d21f2
- SSDEEP 3072:NAoglOwvl4ulkP6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrh1hKM:eene
- TLSH T1B2C3E60B5FB1CCEBD841043A57BAA22D86E7BC440DDCE35687DDCC4634D2918C8AEA57
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects executables built or packed with MPress PE compressor
-
Deletes itself
-
Executes dropped EXE
-
Adds Run key to start application