2026-11-06_ca8ddd0e851ae348ee9071d6592a9254_elex_rhadamanthys_stealc_stop

General

Target
2026-11-06_ca8ddd0e851ae348ee9071d6592a9254_elex_rhadamanthys_stealc_stop
Size 189KB
Sample261107-3d8apswshw
SHA256 aa807ee9c85e17d5292c4de082930c97f4be11e01373e8b2c8bedb7e798f494f
MD5 ca8ddd0e851ae348ee9071d6592a9254
SHA1 9c06b141363fbc902d55f87a9b2f8b420cb220b9
SHA512 56d1808cc0149d132ace245f07f356300218d92e60c0bb3a0c07572a97cd98f7ac56033c1a889af2b19b1af682989b13373d245fd1d3bf0f1f156b75dd7931a4
SSDEEP 3072:LJdsV2Gj/Wwi7qNY5zS4WVSkSK0ekuBPmA0x7hzl:LgW8EJWA9KJPqzl
TLSH
T1EE14BF1131C1C4B3E55A11358916C3B24E7AF8755B256EC7BBC857BE4F3A2C2DA3A382
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-06_ca8ddd0e851ae348ee9071d6592a9254_elex_rhadamanthys_stealc_stop

File Explorer

2026-11-06_ca8ddd0e851ae348ee9071d6592a9254_elex_rhadamanthys_stealc_stop

.exe 189KB

2026-11-06_ca8ddd0e851ae348ee9071d6592a9254_elex_rhadamanthys_stealc_stop

IMPHASH 8327f5d39dfdefc76d2b221902f59751
SHA256 aa807ee9c85e17d5292c4de082930c97f4be11e01373e8b2c8bedb7e798f494f
MD5 ca8ddd0e851ae348ee9071d6592a9254
SHA1 9c06b141363fbc902d55f87a9b2f8b420cb220b9
SHA512 56d1808cc0149d132ace245f07f356300218d92e60c0bb3a0c07572a97cd98f7ac56033c1a889af2b19b1af682989b13373d245fd1d3bf0f1f156b75dd7931a4
SSDEEP 3072:LJdsV2Gj/Wwi7qNY5zS4WVSkSK0ekuBPmA0x7hzl:LgW8EJWA9KJPqzl
TLSH
T1EE14BF1131C1C4B3E55A11358916C3B24E7AF8755B256EC7BBC857BE4F3A2C2DA3A382
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

24251

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\UEBA\Standalone\Release\GAKeyTool.pdb

kernel32

GetModuleHandleExA GetLogicalDriveStringsA lstrcmpiA QueryDosDeviceA lstrlenA lstrcpyA lstrcatA GetCurrentProcessId GetCurrentProcess GetModuleFileNameA LoadLibraryA OutputDebugStringA GetProcAddress CloseHandle SetEndOfFile CreateFileW GetLastError HeapFree TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapAlloc VirtualAlloc HeapReAlloc RaiseException GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetCPInfo GetACP GetOEMCP IsValidCodePage WriteFile WideCharToMultiByte GetConsoleCP GetConsoleMode SetFilePointer ReadFile Sleep FlushFileBuffers ExitProcess FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount RtlUnwind HeapSize MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA GetLocaleInfoW InitializeCriticalSection GetProcessHeap

psapi

GetMappedFileNameA

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-06_ca8ddd0e851ae348ee9071d6592a9254_elex_rhadamanthys_stealc_stop

kernel32

psapi

generic