2026-11-13_c9b8827f31f5d78938937a5bd9ddec6b_elex_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-13_c9b8827f31f5d78938937a5bd9ddec6b_elex_rhadamanthys_stop
Size 101KB
Sample261113-227teagy3n
SHA256 6a13ae979a23010b55111175e598cb4f50b0c0edc8c781783ebc550d86842855
MD5 c9b8827f31f5d78938937a5bd9ddec6b
SHA1 c6b52dff18b6fcd50d689f29ec455009c3797e95
SHA512 c3890c8cc0d08ce19c799665aee705bedd661afa2f9aa3b189d7bb1431ec149b46fca51b70b5a2695950d2d0a7571bd0570b0f421a3317c6fb602d74fb70190c
SSDEEP 1536:nwjDPsyogaDv2BQX2LuW8Lh9096CclLVeVWZtAAao9b0JthdZ87xT1+f:niPsRJ/e6C+LoVOtAEbgZgE
TLSH
T161A38C133560C072C89982724857C753AF36FD519FB8C8433BD97B8EAD743D29A2B295
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-11-13_c9b8827f31f5d78938937a5bd9ddec6b_elex_rhadamanthys_stop

File Explorer

2026-11-13_c9b8827f31f5d78938937a5bd9ddec6b_elex_rhadamanthys_stop

.exe 101KB

2026-11-13_c9b8827f31f5d78938937a5bd9ddec6b_elex_rhadamanthys_stop

IMPHASH 79c5b50b505fe265ef4ee3138c5f3e64
SHA256 6a13ae979a23010b55111175e598cb4f50b0c0edc8c781783ebc550d86842855
MD5 c9b8827f31f5d78938937a5bd9ddec6b
SHA1 c6b52dff18b6fcd50d689f29ec455009c3797e95
SHA512 c3890c8cc0d08ce19c799665aee705bedd661afa2f9aa3b189d7bb1431ec149b46fca51b70b5a2695950d2d0a7571bd0570b0f421a3317c6fb602d74fb70190c
SSDEEP 1536:nwjDPsyogaDv2BQX2LuW8Lh9096CclLVeVWZtAAao9b0JthdZ87xT1+f:niPsRJ/e6C+LoVOtAEbgZgE
TLSH
T161A38C133560C072C89982724857C753AF36FD519FB8C8433BD97B8EAD743D29A2B295
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

e1:74:16:65:87:5c:fd:0d:cb:ae:0a:bb:51:63:c0:63:c5:03:9d:86

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Jonathan Bennett,C=GB,1.2.840.113549.1.9.1=#0c18737570706f7274406175746f69747363726970742e636f6d

Chains

May 22, 2007

CN=Jonathan Bennett,C=GB,1.2.840.113549.1.9.1=#0c18737570706f7274406175746f69747363726970742e636f6d

Subject

CN=Jonathan Bennett,C=GB,1.2.840.113549.1.9.1=#0c18737570706f7274406175746f69747363726970742e636f6d

Serial Number

01:00:00:00:00:01:09:bb:94:49:48

Issuer

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageKeyEncipherment, KeyUsageDataEncipherment

Revocation Status

Not revoked

Timespan

Mar 2, 2006 - Mar 2, 2009

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

02:00:00:00:00:00:d6:78:b7:94:05

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 1, 1998 - Jan 28, 2014

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:08:d9:61:1c:d6

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jan 28, 1999 - Jan 27, 2014

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Serial Number

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2008

Subject

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:08:d9:61:24:48

Issuer

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jan 22, 2004 - Jan 27, 2014

Minor OS version

Major OS version

Entry point

18984

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

comctl32

InitCommonControlsEx

winmm

timeGetTime

kernel32

WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle RtlUnwind InitializeCriticalSection LoadLibraryA GetLocaleInfoA GetStringTypeW GetStringTypeA GetConsoleMode GetConsoleCP SetFilePointer HeapReAlloc VirtualAlloc EnterCriticalSection LeaveCriticalSection GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter VirtualFree HeapCreate HeapDestroy DeleteCriticalSection GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetModuleFileNameA GetStdHandle WriteFile ExitProcess HeapSize Sleep LCMapStringW WideCharToMultiByte LCMapStringA MultiByteToWideChar SetLastError TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP GetACP InterlockedDecrement GlobalLock GetModuleHandleA GlobalAlloc UnmapViewOfFile MapViewOfFile CreateFileMappingA CloseHandle ReadProcessMemory OpenProcess GetVersionExA MulDiv GetCurrentThreadId FreeLibrary GlobalUnlock GetProcAddress InterlockedIncrement FlushFileBuffers GetCommandLineA HeapFree HeapAlloc GetProcessHeap GetStartupInfoA GetLastError TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter RaiseException GetCPInfo CreateFileA

user32

AttachThreadInput OpenClipboard EmptyClipboard GetDesktopWindow SetClipboardData SendMessageTimeoutA ReleaseCapture SendDlgItemMessageA DispatchMessageA SetCapture TranslateMessage SetCursor GetWindowDC IsDialogMessageA EndDeferWindowPos GetMessageA DeferWindowPos SetTimer BeginDeferWindowPos ShowWindow DefWindowProcA GetClientRect SetWindowPos SetWindowTextA GetMenu MessageBoxA CheckMenuItem GetWindowThreadProcessId DestroyWindow LoadCursorA KillTimer LoadImageA PostQuitMessage IsWindowVisible RegisterHotKey GetWindowPlacement ClientToScreen SendMessageA GetCursor EnumChildWindows CreateWindowExA GetWindowTextA RegisterClassExA GetDlgCtrlID LoadIconA EnableWindow DestroyIcon RedrawWindow GetWindowLongA InvalidateRect ReleaseDC GetClassNameA ScreenToClient GetForegroundWindow GetWindowRect GetDC WindowFromPoint GetParent CloseClipboard GetCursorPos MoveWindow

gdi32

Rectangle GetStockObject SelectObject CreatePen DeleteDC BitBlt DeleteObject LineTo GetPixel MoveToEx CreateFontA SetROP2 StretchBlt PatBlt CreateCompatibleBitmap CreateCompatibleDC

comdlg32

ChooseColorA

advapi32

RegSetValueExA RegQueryValueExA RegCloseKey RegOpenKeyExA RegCreateKeyExA

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-13_c9b8827f31f5d78938937a5bd9ddec6b_elex_rhadamanthys_stop

PE Signature issue

comctl32

winmm

kernel32

user32

gdi32

comdlg32

advapi32

generic