General
- Target 2026-11-01_e6fc06ab93cf4b3752e7a39919e94c77_elex_qilin_rhadamanthys
- Size 117KB
- Sample261102-fpkmfshs8m
- SHA256 b80b90147b1953a2e7373ac30919b595d5dec0e6e4d6c81f7eaa23543a935a08
- MD5 e6fc06ab93cf4b3752e7a39919e94c77
- SHA1 064a516401335eae1380b2b18edbb756a5a69bdf
- SHA512 291da7e9335d70486f802df111c40a6dfa8929d75c32702dc9ec04da779b81ee7c629b8c1dd00a7e80f05d9e7aafd81a49bda45e9887a97b4089edfa4a89ec09
- SSDEEP 3072:lAo1lOwvlKlXBP6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrh1hKe:W9nu
- TLSH T115C3F7075FB188EBD840043A17FAA22D86EBBC441DECE257D7DDDC4634D2918C8AEA57
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-11-01_e6fc06ab93cf4b3752e7a39919e94c77_elex_qilin_rhadamanthys.exe
Resource
win10v2004-20260911-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-01_e6fc06ab93cf4b3752e7a39919e94c77_elex_qilin_rhadamanthys.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
blihanstealer
Mutex
-
pomdfghrt
Attributes
-
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; CIBA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Targets
-
- Target 2026-11-01_e6fc06ab93cf4b3752e7a39919e94c77_elex_qilin_rhadamanthys
- Size 117KB
- SHA256 b80b90147b1953a2e7373ac30919b595d5dec0e6e4d6c81f7eaa23543a935a08
- MD5 e6fc06ab93cf4b3752e7a39919e94c77
- SHA1 064a516401335eae1380b2b18edbb756a5a69bdf
- SHA512 291da7e9335d70486f802df111c40a6dfa8929d75c32702dc9ec04da779b81ee7c629b8c1dd00a7e80f05d9e7aafd81a49bda45e9887a97b4089edfa4a89ec09
- SSDEEP 3072:lAo1lOwvlKlXBP6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrh1hKe:W9nu
- TLSH T115C3F7075FB188EBD840043A17FAA22D86EBBC441DECE257D7DDDC4634D2918C8AEA57
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects executables built or packed with MPress PE compressor
-
Deletes itself
-
Executes dropped EXE
-
Adds Run key to start application