General
- Target 2026-11-03_80b46e8f14e05f0ccc497e5f330d1d21_elex_qilin_rhadamanthys
- Size 87KB
- Sample261104-s18jwabs21
- SHA256 e83440bb44a8d76e939f5345ee55d15179a27cc79a0e736ec959d6c74e3d053d
- MD5 80b46e8f14e05f0ccc497e5f330d1d21
- SHA1 489a4ca1aa11b75dfbd7aa144b2eb3a946728af9
- SHA512 932e701ccb9ebc58b5aa7cd70939b1bdda955f32932f89163f7dac0dd82fccba662f5a7730375ac1deb7eec2784cf8e021cad49ce31ea716e6b9ef826fe548a7
- SSDEEP 1536:e6q10k0EFjed6rqJ+6vghzwYu7vih9GueIh9j2IoHAjUvJQ/johleHhvGhZchUXk:E1oEFlt6vghzwYu7vih9GueIh9j2IoHe
- TLSH T12C933A5B8AA2CCEBD810003B57EAA27C86EBFC411DDCE3968BDDC81634D2918C95E557
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-11-03_80b46e8f14e05f0ccc497e5f330d1d21_elex_qilin_rhadamanthys.exe
Resource
win10v2004-20260911-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-03_80b46e8f14e05f0ccc497e5f330d1d21_elex_qilin_rhadamanthys.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
blihanstealer
Mutex
-
pomdfghrt
Attributes
-
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; CIBA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Targets
-
- Target 2026-11-03_80b46e8f14e05f0ccc497e5f330d1d21_elex_qilin_rhadamanthys
- Size 87KB
- SHA256 e83440bb44a8d76e939f5345ee55d15179a27cc79a0e736ec959d6c74e3d053d
- MD5 80b46e8f14e05f0ccc497e5f330d1d21
- SHA1 489a4ca1aa11b75dfbd7aa144b2eb3a946728af9
- SHA512 932e701ccb9ebc58b5aa7cd70939b1bdda955f32932f89163f7dac0dd82fccba662f5a7730375ac1deb7eec2784cf8e021cad49ce31ea716e6b9ef826fe548a7
- SSDEEP 1536:e6q10k0EFjed6rqJ+6vghzwYu7vih9GueIh9j2IoHAjUvJQ/johleHhvGhZchUXk:E1oEFlt6vghzwYu7vih9GueIh9j2IoHe
- TLSH T12C933A5B8AA2CCEBD810003B57EAA27C86EBFC411DDCE3968BDDC81634D2918C95E557
- MD5 SHA1 SHA512 SSDEEP TLSH
- Custom signature
Detects executables built or packed with MPress PE compressor
Deletes itself
Executes dropped EXE
Adds Run key to start application