2026-11-01_fc46324c8401ae96ac70c8163f4fc53d_elex_karagany_rhadamanthys_stop

General

Target
2026-11-01_fc46324c8401ae96ac70c8163f4fc53d_elex_karagany_rhadamanthys_stop
Size 5.7MB
Sample261102-cbc4nsdh59
SHA256 d407e95e387c72059e167df438d68c75b2ffee35d2f8cd3f8caad1e64084a295
MD5 fc46324c8401ae96ac70c8163f4fc53d
SHA1 31f1d6de682e7259efd121a09ea1468b48912c2d
SHA512 6c1b1a1851c209630f087e80605026e50b3b9df872c2b09dc5d2c886ab05cb9e7f62ef3cd3caa633aee8c19d613966e5e44f77c36f061a29f7db43fb723a31aa
SSDEEP 98304:P9KmZm98WL2zlbqSNzkSwFCSXMcKGXXxItI/ITPAJhLhHGTsPrCyc9i6Mlg2fGFN:P9DpXbHqJXsOE4XhOUkinlgUGr
TLSH
T170563340FAD010F0C6EB6C324CF65A9215B9AE9ACCD1F98739E4BA017C70D91572DA6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_fc46324c8401ae96ac70c8163f4fc53d_elex_karagany_rhadamanthys_stop

File Explorer

2026-11-01_fc46324c8401ae96ac70c8163f4fc53d_elex_karagany_rhadamanthys_stop

.exe 5.7MB

2026-11-01_fc46324c8401ae96ac70c8163f4fc53d_elex_karagany_rhadamanthys_stop

IMPHASH 9b0974e10a21ff44f065d582c0872e7e
SHA256 d407e95e387c72059e167df438d68c75b2ffee35d2f8cd3f8caad1e64084a295
MD5 fc46324c8401ae96ac70c8163f4fc53d
SHA1 31f1d6de682e7259efd121a09ea1468b48912c2d
SHA512 6c1b1a1851c209630f087e80605026e50b3b9df872c2b09dc5d2c886ab05cb9e7f62ef3cd3caa633aee8c19d613966e5e44f77c36f061a29f7db43fb723a31aa
SSDEEP 98304:P9KmZm98WL2zlbqSNzkSwFCSXMcKGXXxItI/ITPAJhLhHGTsPrCyc9i6Mlg2fGFN:P9DpXbHqJXsOE4XhOUkinlgUGr
TLSH
T170563340FAD010F0C6EB6C324CF65A9215B9AE9ACCD1F98739E4BA017C70D91572DA6F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

11641

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InitializeCriticalSectionAndSpinCount LockResource GetProcAddress VirtualAlloc GetLastError LoadResource SizeofResource GetFileSize WriteFile ReadFile CloseHandle LoadLibraryA GetModuleFileNameW GetModuleHandleW CreateProcessW GetEnvironmentVariableW SetEnvironmentVariableW FindResourceW FindResourceExW GetTempPathW GetTempFileNameW CreateFileW DeleteFileW MultiByteToWideChar WideCharToMultiByte GetCommandLineW HeapFree GetSystemTimeAsFileTime RaiseException RtlUnwind SetLastError InterlockedIncrement InterlockedDecrement GetCurrentThreadId EncodePointer DecodePointer ExitProcess GetModuleHandleExW GetStdHandle GetProcessHeap GetFileType DeleteCriticalSection GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree IsProcessorFeaturePresent IsDebuggerPresent HeapAlloc HeapReAlloc HeapSize EnterCriticalSection LeaveCriticalSection Sleep IsValidCodePage GetACP GetOEMCP GetCPInfo LoadLibraryExW OutputDebugStringW LoadLibraryW GetStringTypeW LCMapStringW FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx SetStdHandle WriteConsoleW HeapDestroy

shell32

ShellExecuteW

shlwapi

PathRenameExtensionW PathFileExistsW

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_fc46324c8401ae96ac70c8163f4fc53d_elex_karagany_rhadamanthys_stop

kernel32

shell32

shlwapi

generic