General
- Target 2026-11-09_952a1c7f1fdb8c871da3b2e56f0b96c6_elex_rhadamanthys_stop
- Size 468KB
- Sample261109-3tc5hasv5p
- SHA256 39885aff39aa8fbc7a2dde35d816ef51b1577e140daf7aabaddbf9955ed54135
- MD5 952a1c7f1fdb8c871da3b2e56f0b96c6
- SHA1 bd0c91d91ecec4b36f472493d8b947ddbc70e227
- SHA512 7951cbd5c835f69a3e395fcf33f146cfc9efe194a7e3c172f11d443ed98d8bbbf469300df8d5c8f220441c042aadae35b253c5f309f82bfdb953f87c27e71760
- SSDEEP 12288:93CtSokfFGUMKwlTIU/b37dJ75WEe+eKTxB6mFo:9x9GzHlTv/b35tecFB6D
- TLSH T18AA4CF113A80C472E36627750996E6F11AAABC3849A4D28FFA787F395D311934A3734F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-11-09_952a1c7f1fdb8c871da3b2e56f0b96c6_elex_rhadamanthys_stop.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-09_952a1c7f1fdb8c871da3b2e56f0b96c6_elex_rhadamanthys_stop.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
121.88.5.183
-
121.88.5.184
Targets
-
- Target 2026-11-09_952a1c7f1fdb8c871da3b2e56f0b96c6_elex_rhadamanthys_stop
- Size 468KB
- SHA256 39885aff39aa8fbc7a2dde35d816ef51b1577e140daf7aabaddbf9955ed54135
- MD5 952a1c7f1fdb8c871da3b2e56f0b96c6
- SHA1 bd0c91d91ecec4b36f472493d8b947ddbc70e227
- SHA512 7951cbd5c835f69a3e395fcf33f146cfc9efe194a7e3c172f11d443ed98d8bbbf469300df8d5c8f220441c042aadae35b253c5f309f82bfdb953f87c27e71760
- SSDEEP 12288:93CtSokfFGUMKwlTIU/b37dJ75WEe+eKTxB6mFo:9x9GzHlTv/b35tecFB6D
- TLSH T18AA4CF113A80C472E36627750996E6F11AAABC3849A4D28FFA787F395D311934A3734F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE