2026-04-06_a4f167187b5ee03649ad29a49b18a5aa_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-06_a4f167187b5ee03649ad29a49b18a5aa_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
Size 1.2MB
Sample260406-e2x8mscv9s
SHA256 77bd2b41d5578e566b1dc5a30aafa62f8feceefcf2826c6700c7b70e9dba0ccb
MD5 a4f167187b5ee03649ad29a49b18a5aa
SHA1 ced8e621c9a3d146a0d85f9a1599b95d2cd2be51
SHA512 c5cd3c054aa28cd74d85bd9967592ba34afa6b66ba3cdad51e878c5de798710db33b9d52304d45b4f98780548eb7a82d486b9da80143caabf98e779ae4171df8
SSDEEP 12288:FPTIoIXI014mkOvMls/j6BzxRiTCtf6suT+RSLn8XfUsGBTWE8LqANer5+n:lQjPvM86hx4A9GnwcTWSA
TLSH
T1A6456B03E3916CC6D7994672DE09C1A4631AF06DAFFB5371740C538EAF63386BE52A24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-06_a4f167187b5ee03649ad29a49b18a5aa_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

File Explorer

2026-04-06_a4f167187b5ee03649ad29a49b18a5aa_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

.exe 1.2MB

2026-04-06_a4f167187b5ee03649ad29a49b18a5aa_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

IMPHASH d5555405ac36a198d312d7dfaf56a1ed
SHA256 77bd2b41d5578e566b1dc5a30aafa62f8feceefcf2826c6700c7b70e9dba0ccb
MD5 a4f167187b5ee03649ad29a49b18a5aa
SHA1 ced8e621c9a3d146a0d85f9a1599b95d2cd2be51
SHA512 c5cd3c054aa28cd74d85bd9967592ba34afa6b66ba3cdad51e878c5de798710db33b9d52304d45b4f98780548eb7a82d486b9da80143caabf98e779ae4171df8
SSDEEP 12288:FPTIoIXI014mkOvMls/j6BzxRiTCtf6suT+RSLn8XfUsGBTWE8LqANer5+n:lQjPvM86hx4A9GnwcTWSA
TLSH
T1A6456B03E3916CC6D7994672DE09C1A4631AF06DAFFB5371740C538EAF63386BE52A24
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20408

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLogicalDriveStringsW SetDefaultCommConfigW CreateHardLinkA GetConsoleAliasesA LoadLibraryW _hread IsBadCodePtr CreateEventA FormatMessageW GetFileAttributesA GetExitCodeProcess SetConsoleMode WritePrivateProfileSectionW ChangeTimerQueueTimer SetLastError GetProcAddress VirtualAlloc GlobalAddAtomA WriteConsoleA LocalAlloc FoldStringA FreeEnvironmentStringsW VirtualProtect GetWindowsDirectoryW GetFileInformationByHandle GlobalReAlloc InterlockedPushEntrySList LCMapStringW CloseHandle CreateFileA HeapSize FlushFileBuffers lstrcpynA CallNamedPipeA EnumSystemCodePagesW GetVolumeNameForVolumeMountPointA GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetLastError HeapFree GetModuleHandleW Sleep ExitProcess WriteFile GetModuleFileNameA GetModuleFileNameW GetEnvironmentStringsW GetCommandLineW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind RaiseException SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount MultiByteToWideChar HeapAlloc HeapReAlloc LoadLibraryA SetStdHandle GetConsoleOutputCP WriteConsoleW LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA

user32

ClientToScreen LoadMenuA InvalidateRgn MessageBoxIndirectA GetMenuInfo CountClipboardFormats SetScrollInfo

gdi32

GetGlyphIndicesW

advapi32

RegOpenKeyA

Name

.text

Size

643KB

Virtual Size

642KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

38.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

104KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

QVkmUcsO

Size

18KB

Virtual Size

17KB

Characteristics

Name

IHclFxzT

Size

2KB

Virtual Size

2KB

Characteristics

Name

oLykiKDA

Size

4KB

Virtual Size

4KB

Characteristics

Name

idFHWetu

Size

35KB

Virtual Size

34KB

Characteristics

Name

VOJHmHYc

Size

168KB

Virtual Size

167KB

Characteristics

Name

mjgDmANb

Size

28KB

Virtual Size

28KB

Characteristics

Name

OXCMftap

Size

2KB

Virtual Size

1KB

Characteristics

Name

RLwZBCUe

Size

127KB

Virtual Size

127KB

Characteristics

Name

BrlwtlYz

Size

512B

Virtual Size

267B

Characteristics

Name

wGlsfpDn

Size

60KB

Virtual Size

59KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-06_a4f167187b5ee03649ad29a49b18a5aa_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

kernel32

user32

gdi32

advapi32

generic