2026-10-30_caaabf6b9b6bcdb3911549133d472356_elex_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-30_caaabf6b9b6bcdb3911549133d472356_elex_rhadamanthys_stop
Size 97KB
Sample261030-vc3d3afa53
SHA256 01b2d095bde5ebb15ce53090c71792484b20f0c752411b97d87f76209835a1ed
MD5 caaabf6b9b6bcdb3911549133d472356
SHA1 2ce5fec3fde76590d7cbaa0147a1ee348e2256e1
SHA512 0c02ff70f2b11e5dc09737426edf7afa283c8c3870df2f68476918c581809b0d391f539f6808e6092b8aa20b600a5ed3070d027f464dfc7d092b99e9fef330a3
SSDEEP 1536:sLpPGLVIUhCNRY6ygBM6C/rOZgEOjfjRt6gZWLCRoFPbJ38tl+GnAvvnNc:sFPGLVDhFD3ELCRoFDJstl3Avvna
TLSH
T1D4A37C1276D2C0B1F8514A3544A9CF925F3B7C036BB9D2DBBB900A4F6E613D0DA7235A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-10-30_caaabf6b9b6bcdb3911549133d472356_elex_rhadamanthys_stop

File Explorer

2026-10-30_caaabf6b9b6bcdb3911549133d472356_elex_rhadamanthys_stop

.exe 97KB

2026-10-30_caaabf6b9b6bcdb3911549133d472356_elex_rhadamanthys_stop

IMPHASH 76dae34c9ed587730b35ade2045f505f
SHA256 01b2d095bde5ebb15ce53090c71792484b20f0c752411b97d87f76209835a1ed
MD5 caaabf6b9b6bcdb3911549133d472356
SHA1 2ce5fec3fde76590d7cbaa0147a1ee348e2256e1
SHA512 0c02ff70f2b11e5dc09737426edf7afa283c8c3870df2f68476918c581809b0d391f539f6808e6092b8aa20b600a5ed3070d027f464dfc7d092b99e9fef330a3
SSDEEP 1536:sLpPGLVIUhCNRY6ygBM6C/rOZgEOjfjRt6gZWLCRoFPbJ38tl+GnAvvnNc:sFPGLVDhFD3ELCRoFDJstl3Avvna
TLSH
T1D4A37C1276D2C0B1F8514A3544A9CF925F3B7C036BB9D2DBBB900A4F6E613D0DA7235A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

b7:3f:ab:6d:78:60:5b:eb:28:66:20:f6:88:eb:36:11

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Ability Plus Software (UK) Ltd,O=Ability Plus Software (UK) Ltd,L=London,ST=London,C=GB

Chains

Jan 1, 0001

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Serial Number

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Timespan

Aug 1, 1996 - Dec 31, 2020

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Serial Number

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Aug 6, 2003 - Aug 5, 2013

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=Ability Plus Software (UK) Ltd,O=Ability Plus Software (UK) Ltd,L=London,ST=London,C=GB

Serial Number

0d:cf:b8:95:4a:86:0a:7b:ad:8d:2e:4d:06:5b:e6:aa

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Apr 27, 2010 - Apr 27, 2011

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Minor OS version

Major OS version

Entry point

23577

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrlenA FreeLibrary CloseHandle GetLastError GetModuleFileNameA GetSystemDirectoryA GetExitCodeProcess CreateProcessA CreateMutexA GlobalFree GlobalAlloc VerifyVersionInfoA VerSetConditionMask GetVersionExA GetCurrentProcess GetEnvironmentVariableA LocalFree FormatMessageA OutputDebugStringA WideCharToMultiByte LockResource LoadResource FindResourceA MultiByteToWideChar GetFullPathNameA GetFileAttributesA LoadLibraryA FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle RtlUnwind InitializeCriticalSection HeapReAlloc VirtualAlloc HeapSize GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA Sleep LeaveCriticalSection EnterCriticalSection GetConsoleMode CompareStringA GetProcAddress GetConsoleCP SetFilePointer VirtualFree HeapCreate HeapDestroy QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter GetCommandLineA HeapFree HeapAlloc GetProcessHeap GetStartupInfoA IsDebuggerPresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError RaiseException ExitProcess WriteFile GetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection

advapi32

FreeSid AllocateAndInitializeSid

user32

CharPrevA ExitWindowsEx MessageBoxA LoadStringA GetSystemMetrics SystemParametersInfoA GetWindowRect DestroyWindow CharNextA MsgWaitForMultipleObjects CreateDialogParamA SetWindowTextA MoveWindow SetFocus ShowWindow SetForegroundWindow LoadIconA LoadCursorA SetCursor GetDlgItem SendMessageA PeekMessageA IsDialogMessageA TranslateMessage DispatchMessageA SetDlgItemTextA

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

comctl32

InitCommonControlsEx

urlmon

URLDownloadToCacheFileA

wininet

DeleteUrlCacheEntry InternetCanonicalizeUrlA

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-30_caaabf6b9b6bcdb3911549133d472356_elex_rhadamanthys_stop

PE Signature issue

kernel32

advapi32

user32

version

comctl32

urlmon

wininet

generic