General
- Target 2026-11-01_ec9dce47bcb95fbb04fd1a7f859ea205_elex_qilin_rhadamanthys
- Size 136KB
- Sample261102-eskaessv7j
- SHA256 8a4894310912ee4fdb65d7f318329cdb62a71fe00a3c45325710ef83d37f0fdc
- MD5 ec9dce47bcb95fbb04fd1a7f859ea205
- SHA1 2fcd51530054bd632ff8931cbe1fa04148a9364a
- SHA512 f92386896eb7e673dae0b98ff48a494a268e81481cc034e36ec4702fdd7e3961af845a3325a85d18d993e8cf9e9352134a5fc7d0e8cebcc3b10318af0fe7e6a6
- SSDEEP 3072:lAo1lOwvlKlXBP6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrh1hKB:W9nu
- TLSH T17BD3D50B5EB1CCDBD841043A57FAA22D86E7BC440DECE35687DECC4635C2918C9AEA57
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-11-01_ec9dce47bcb95fbb04fd1a7f859ea205_elex_qilin_rhadamanthys.exe
Resource
win10v2004-20260911-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-01_ec9dce47bcb95fbb04fd1a7f859ea205_elex_qilin_rhadamanthys.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
blihanstealer
Mutex
-
pomdfghrt
Attributes
-
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; CIBA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Targets
-
- Target 2026-11-01_ec9dce47bcb95fbb04fd1a7f859ea205_elex_qilin_rhadamanthys
- Size 136KB
- SHA256 8a4894310912ee4fdb65d7f318329cdb62a71fe00a3c45325710ef83d37f0fdc
- MD5 ec9dce47bcb95fbb04fd1a7f859ea205
- SHA1 2fcd51530054bd632ff8931cbe1fa04148a9364a
- SHA512 f92386896eb7e673dae0b98ff48a494a268e81481cc034e36ec4702fdd7e3961af845a3325a85d18d993e8cf9e9352134a5fc7d0e8cebcc3b10318af0fe7e6a6
- SSDEEP 3072:lAo1lOwvlKlXBP6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrh1hKB:W9nu
- TLSH T17BD3D50B5EB1CCDBD841043A57FAA22D86E7BC440DECE35687DECC4635C2918C9AEA57
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects executables built or packed with MPress PE compressor
-
Deletes itself
-
Executes dropped EXE
-
Adds Run key to start application