General
- Target 2026-11-01_96abbbb81f9bb4cfbf1720aad817dbde_elex_qilin_rhadamanthys
- Size 126KB
- Sample261102-rl4rpsfc98
- SHA256 0d696cca5a7b6d3b7c2dc27c79bc92847c83c5331e6349a6212fb6a635d5b958
- MD5 96abbbb81f9bb4cfbf1720aad817dbde
- SHA1 2a5d4c02a2aed801112a1ebefb6a455d07f8f774
- SHA512 0e259dfee87dde34bcb1ecd0a6f6477c7735e9bac50314e476503df7287e7c1d20eab901a41cbe7d64120a57cc6c7d5b5f8da0fc0101dee14b97e588f607ba1c
- SSDEEP 3072:NAoglOwvl4ulkP6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrh1hK5:eene
- TLSH T149C3E7076FA1CCEBD841003A57FAA22C86EBBC440DDCE35697DDCC4634D2918C9AEA57
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-11-01_96abbbb81f9bb4cfbf1720aad817dbde_elex_qilin_rhadamanthys.exe
Resource
win10v2004-20260911-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-01_96abbbb81f9bb4cfbf1720aad817dbde_elex_qilin_rhadamanthys.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
blihanstealer
Mutex
-
pomdfghrt
Attributes
-
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; CIBA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Targets
-
- Target 2026-11-01_96abbbb81f9bb4cfbf1720aad817dbde_elex_qilin_rhadamanthys
- Size 126KB
- SHA256 0d696cca5a7b6d3b7c2dc27c79bc92847c83c5331e6349a6212fb6a635d5b958
- MD5 96abbbb81f9bb4cfbf1720aad817dbde
- SHA1 2a5d4c02a2aed801112a1ebefb6a455d07f8f774
- SHA512 0e259dfee87dde34bcb1ecd0a6f6477c7735e9bac50314e476503df7287e7c1d20eab901a41cbe7d64120a57cc6c7d5b5f8da0fc0101dee14b97e588f607ba1c
- SSDEEP 3072:NAoglOwvl4ulkP6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrh1hK5:eene
- TLSH T149C3E7076FA1CCEBD841003A57FAA22C86EBBC440DDCE35697DDCC4634D2918C9AEA57
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects executables built or packed with MPress PE compressor
-
Deletes itself
-
Executes dropped EXE
-
Adds Run key to start application