2026-04-03_738a09d7742bd2c981c3022358770d5a_amadey_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-03_738a09d7742bd2c981c3022358770d5a_amadey_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stop
Size 1.3MB
Sample260403-sethtscv9n
SHA256 8f643e6ca65609fbf278f735b95d5e9cd4a5e4e85f8a4054da88c9d6ad3a31bb
MD5 738a09d7742bd2c981c3022358770d5a
SHA1 1d82d436d47f038907e2ad36d8fb3d3e249912cb
SHA512 5c04781c4af22ba414de052cf4e63a48c5c28d2533a09fe91bbf642d6aa4d39abf0c7e31faf971f3edfffcd1d7d2fbcc54e57de0c431d13221527cd53a2492cc
SSDEEP 24576:9DV1WxOT1dJrEmsjJk8A0dsGiAhoAHsaLFZhgX0U:9BYxO5bE5jJvhrHxFHg
TLSH
T18D55D003B395BCE2D6A54734AD2895D8772BF850AE2143A6740C571F8E733E4CE67B28
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-03_738a09d7742bd2c981c3022358770d5a_amadey_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stop

File Explorer

2026-04-03_738a09d7742bd2c981c3022358770d5a_amadey_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stop

.exe 1.3MB

2026-04-03_738a09d7742bd2c981c3022358770d5a_amadey_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stop

IMPHASH 44b1211815eb04dba3878a847875e976
SHA256 8f643e6ca65609fbf278f735b95d5e9cd4a5e4e85f8a4054da88c9d6ad3a31bb
MD5 738a09d7742bd2c981c3022358770d5a
SHA1 1d82d436d47f038907e2ad36d8fb3d3e249912cb
SHA512 5c04781c4af22ba414de052cf4e63a48c5c28d2533a09fe91bbf642d6aa4d39abf0c7e31faf971f3edfffcd1d7d2fbcc54e57de0c431d13221527cd53a2492cc
SSDEEP 24576:9DV1WxOT1dJrEmsjJk8A0dsGiAhoAHsaLFZhgX0U:9BYxO5bE5jJvhrHxFHg
TLSH
T18D55D003B395BCE2D6A54734AD2895D8772BF850AE2143A6740C571F8E733E4CE67B28
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16675

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\bojay-kiligam.pdb

kernel32

GetConsoleAliasesLengthW TlsGetValue SystemTimeToTzSpecificLocalTime EndUpdateResourceW InterlockedIncrement GetCurrentProcess CreateJobObjectW OpenSemaphoreA GetModuleHandleW GetTickCount GetWindowsDirectoryA EnumTimeFormatsW GlobalAlloc SetFileShortNameW GlobalFindAtomA Sleep AssignProcessToJobObject SizeofResource GetSystemWindowsDirectoryA FormatMessageW SetConsoleCursorPosition CreateFileW GetVolumePathNameA LCMapStringA FindFirstChangeNotificationW GetLastError SetLastError BackupRead GetProcAddress VirtualAlloc BeginUpdateResourceW EnumDateFormatsExA SetComputerNameA LoadLibraryA InterlockedExchangeAdd CreateFileMappingA FindFirstVolumeMountPointW HeapLock FoldStringW FindFirstVolumeMountPointA VirtualProtect GetVersionExA DeleteTimerQueueTimer GlobalAddAtomW ReadConsoleOutputCharacterW GetComputerNameA GetDateFormatW InterlockedExchange GetFullPathNameW CreateFileA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA CloseHandle UnhandledExceptionFilter SetUnhandledExceptionFilter ExitProcess GetCommandLineA GetStartupInfoA WriteFile GetStdHandle GetModuleFileNameA TlsAlloc TlsSetValue TlsFree GetCurrentThreadId InterlockedDecrement HeapSize EnterCriticalSection LeaveCriticalSection TerminateProcess IsDebuggerPresent HeapFree DeleteCriticalSection InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage HeapAlloc HeapReAlloc RtlUnwind GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW LCMapStringW GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer RaiseException

user32

GetWindowTextLengthW

gdi32

SetDeviceGammaRamp

advapi32

ReadEventLogA

shell32

ShellAboutW

ole32

CoRegisterPSClsid

winhttp

WinHttpCheckPlatform

msimg32

AlphaBlend

Name

.text

Size

872KB

Virtual Size

871KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

82KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

zmgiEkqe

Size

45KB

Virtual Size

44KB

Characteristics

Name

HjSpPmpP

Size

3KB

Virtual Size

3KB

Characteristics

Name

JmJbgYfh

Size

2KB

Virtual Size

2KB

Characteristics

Name

ipLYOTnD

Size

140KB

Virtual Size

140KB

Characteristics

Name

pRULBDRi

Size

51KB

Virtual Size

50KB

Characteristics

Name

VLAzYtBs

Size

103KB

Virtual Size

103KB

Characteristics

Name

CLbneSER

Size

2KB

Virtual Size

1KB

Characteristics

Name

HNdVCSZj

Size

18KB

Virtual Size

17KB

Characteristics

Name

vvBUAqiw

Size

2KB

Virtual Size

1KB

Characteristics

Name

oBKQjTHq

Size

29KB

Virtual Size

28KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-03_738a09d7742bd2c981c3022358770d5a_amadey_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stop

kernel32

user32

gdi32

advapi32

shell32

ole32

winhttp

msimg32

generic