2026-03-07_8a1934414a183f74eb98d1ee624b5978_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop

General

Target
2026-03-07_8a1934414a183f74eb98d1ee624b5978_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop
Size 887KB
Sample260307-enzjjsdy61
SHA256 5072ae603a238142cca3e3fedb774efa14c457a25ce8e1acdf83e88ed1b94e50
MD5 8a1934414a183f74eb98d1ee624b5978
SHA1 21a7b9e0b0e2d9eaecc204eb3bb2e156a36fed82
SHA512 2e9d8b883ccad2cbb7c8b324ec0b53e28fbece7cf2230b5596885e2974196e8bdaeb2890d83826e882b2b5a15e5a33caa57c012f84de124f9b4ba277a4b5c811
SSDEEP 12288:27D2B/BSBPPdVUQK6HeZ+0PRJl0cTPqvo4qMP/AWFtl7OCcg0kY:2dEQlXplvo4bP
TLSH
T123158EBA9378E455E4EFEC36D91442A6101389B25C8CC2DF2D85268979B1F8D1FFE10B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-03-07_8a1934414a183f74eb98d1ee624b5978_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop

File Explorer

2026-03-07_8a1934414a183f74eb98d1ee624b5978_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop

.exe 887KB

2026-03-07_8a1934414a183f74eb98d1ee624b5978_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop

IMPHASH 2b7b16ea6305513a3787fed6f5a40b28
SHA256 5072ae603a238142cca3e3fedb774efa14c457a25ce8e1acdf83e88ed1b94e50
MD5 8a1934414a183f74eb98d1ee624b5978
SHA1 21a7b9e0b0e2d9eaecc204eb3bb2e156a36fed82
SHA512 2e9d8b883ccad2cbb7c8b324ec0b53e28fbece7cf2230b5596885e2974196e8bdaeb2890d83826e882b2b5a15e5a33caa57c012f84de124f9b4ba277a4b5c811
SSDEEP 12288:27D2B/BSBPPdVUQK6HeZ+0PRJl0cTPqvo4qMP/AWFtl7OCcg0kY:2dEQlXplvo4bP
TLSH
T123158EBA9378E455E4EFEC36D91442A6101389B25C8CC2DF2D85268979B1F8D1FFE10B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

74:37:3b:85:ee:8b:5b:37:48:b5:5d:6e:ec:5b:fc:9f:aa:82:d4:c1:bb:e0:89:98:04:b4:32:06:af:9c:ee:87

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=556703-7485,CN=Spotify AB,O=Spotify AB,L=Stockholm,C=SE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025345

Chains

Dec 4, 2023

SERIALNUMBER=556703-7485,CN=Spotify AB,O=Spotify AB,L=Stockholm,C=SE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025345

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=556703-7485,CN=Spotify AB,O=Spotify AB,L=Stockholm,C=SE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025345

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=556703-7485,CN=Spotify AB,O=Spotify AB,L=Stockholm,C=SE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025345

Serial Number

0f:ab:67:0a:61:bf:4b:7d:af:d5:59:35:6b:5b:cc:ff

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 4, 2023 - Oct 3, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

5

Entry point

5225

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VirtualProtect WaitForSingleObject Sleep CreateThread lstrlenW GetProcAddress LoadLibraryA VirtualAlloc FreeConsole HeapSize GetLocaleInfoA GetCommandLineA GetModuleHandleA SetUnhandledExceptionFilter GetModuleHandleW ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetLastError GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapCreate VirtualFree HeapFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent LeaveCriticalSection EnterCriticalSection InitializeCriticalSectionAndSpinCount HeapAlloc HeapReAlloc RtlUnwind LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW

user32

GetClassInfoA CallWindowProcA SetWindowLongA CheckDlgButton GetActiveWindow LoadCursorA MessageBoxA wsprintfA GetDlgItemTextA

Name

.text

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.mgjh

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

539KB

Virtual Size

541KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.7aAb

Size

48KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_MEM_READ

Name

.idata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-03-07_8a1934414a183f74eb98d1ee624b5978_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop

PE Signature issue

kernel32

user32

generic