| Hash / Info | Value |
|---|---|
| SHA256 | 5e79bf224441e7892090bb9c54fca3e264377202b1c79fde91c8d762a0aafe9b |
| MD5 | d915cbf584f3fac508a626b2b461d556 |
| SHA1 | 3008b913799ddbf3ccf0ea8b51821800fde165f1 |
| ImpHash | 772ec87d3452991a9933a3ba0d9963a9 |
| File Adi | Nexora.exe |
| File Type | exe |
| Size | 71,450,112 bytes |
| First Seen | 2026-02-28 |
Tehdit Valuelendirmesi
Bu ornek, etkilenen sistemlerdeki hassas kimlik bilgilerini ve kisisel verileri toplayan bir bilgi hırsızı (infostealer) olarak siniflandirilmistir. Tarayici kayitli parolalar, cerezler, kripto para cüzdani verileri ve oturum tokenlari birincil hedefleridir.
Detected Capabilities
- Tarayici Kimlik Bilgileri
- Cerez Hirsizligi
- Kripto Cüzdan
- 2FA Kodu
- Sistem Bilgisi
MalwareBazaar Tags
Analysis Note
Bu ornek Rhadamanthys ailesine ait ve MalwareBazaar platformundan alınmıstır. KEYDAL Guvenlik Arastirmaları tarafından metadata analizi gerceklestirilmis ve IOC veritabanına eklenmistir.
Rhadamanthys — Malware Profile
Rhadamanthys, 2022 de ortaya cikan C++ premium infostealer ailesidir. 250 USD/ay abonelik. Tarayici, kripto, FTP, VPN, email, oyun platformlarini hedefler. Loader + stealer DLL mimarisi.
Technical Details
C++, HTTP/HTTPS C2, modular plugin-tabanli mimari, genis tarayici credential theft, kripto wallet scraper (MetaMask/Phantom), steganography destekli payload, fingerprint (UUID/HWID), process injection
Capabilities & Behavior
IOC List (2 indicators)
# SHA256
5e79bf224441e7892090bb9c54fca3e264377202b1c79fde91c8d762a0aafe9b
# MD5
d915cbf584f3fac508a626b2b461d556
| Type | Value | Note |
|---|---|---|
| sha256 | 5e79bf224441e7892090bb9c54fca3e264377202b1c79fde91c8d762a0aafe9b | |
| md5 | d915cbf584f3fac508a626b2b461d556 |
C2 Servers (4 recorded servers for this family)
| Address | Type | Port | Protocol | Status | Country |
|---|---|---|---|---|---|
| 94.131.106.195 | ip | 443 | HTTPS | inactive | RU |
| 185.106.122.144 | ip | 443 | HTTPS | inactive | CZ |
| 185.106.120.55 | ip | 80 | HTTP | inactive | RU |
| 176.46.152.62 | ip | 5858 | HTTP | inactive | — |
C2 addresses are provided only from malware samples manually verified by the KEYDAL team. Commercial use is prohibited.