2026-04-15_472b4e916c632b0bf4de2cc841ddb0b1_amadey_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-15_472b4e916c632b0bf4de2cc841ddb0b1_amadey_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
Size 1.2MB
Sample260415-te3beafs41
SHA256 7b04fd6087f8e29f8e73799d19f428cfa8af6f2ad496c03b44c9381d600ac420
MD5 472b4e916c632b0bf4de2cc841ddb0b1
SHA1 ca3f611dc519a95cb5b361e839a4c44c7e2557ba
SHA512 b5f7f55e1d3de361341eb401bee3357e5989136bd1bb68fc070d804abc04b224edcad86b6b86066e623d8266f292dfc92cc06fefe6f60a2d7dfde79f4c24e2e7
SSDEEP 24576:9N4PsNBM/9/fwK/FTwfCBM0VZeg14kGx/WnSyhbzv8O0X:isNBk9/fw2BwfmM0fMkuWSytLdu
TLSH
T1F7559D32F250B032D7710172AA69B6317A7CA9312F1976D7E3A8AF1D3AF44D16636307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-15_472b4e916c632b0bf4de2cc841ddb0b1_amadey_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-04-15_472b4e916c632b0bf4de2cc841ddb0b1_amadey_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

.exe 1.2MB

2026-04-15_472b4e916c632b0bf4de2cc841ddb0b1_amadey_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 9bd8499d2ac056a616bc7696c39c263b
SHA256 7b04fd6087f8e29f8e73799d19f428cfa8af6f2ad496c03b44c9381d600ac420
MD5 472b4e916c632b0bf4de2cc841ddb0b1
SHA1 ca3f611dc519a95cb5b361e839a4c44c7e2557ba
SHA512 b5f7f55e1d3de361341eb401bee3357e5989136bd1bb68fc070d804abc04b224edcad86b6b86066e623d8266f292dfc92cc06fefe6f60a2d7dfde79f4c24e2e7
SSDEEP 24576:9N4PsNBM/9/fwK/FTwfCBM0VZeg14kGx/WnSyhbzv8O0X:isNBk9/fw2BwfmM0fMkuWSytLdu
TLSH
T1F7559D32F250B032D7710172AA69B6317A7CA9312F1976D7E3A8AF1D3AF44D16636307
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20108

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\re\jdk7u45\229\build\windows-amd64\tmp\javacplexec\obj64\javacpl.pdb

user32

MessageBoxW LoadStringW wsprintfW

msvcr100

__dllonexit _lock _onexit ?_type_info_dtor_internal_method@type_info@@QEAAXXZ __crt_debugger_hook __set_app_type _fmode _commode __setusermatherr ??2@YAPEAX_K@Z _configthreadlocale _initterm_e _initterm _acmdln exit _cexit _ismbblead _exit _XcptFilter __getmainargs _amsg_exit __C_specific_handler ?terminate@@YAXXZ memcpy _vsnwprintf_s _ftime64_s wcsftime _snwprintf_s _localtime64 wcsncpy_s _wstat64i32 wcscat_s memcpy_s _wsplitpath_s wcscpy_s _wtoi memset swprintf_s ??_U@YAPEAX_K@Z ??3@YAXPEAX@Z __CxxFrameHandler3 _stat64i32 _CxxThrowException malloc ??_V@YAXPEAX@Z free _unlock

kernel32

LoadLibraryW LocalFree WideCharToMultiByte lstrlenA MultiByteToWideChar RaiseException GetSystemTimeAsFileTime GetTickCount QueryPerformanceCounter DecodePointer RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess EncodePointer GetStartupInfoW Sleep GetCurrentThreadId GetCurrentProcessId OutputDebugStringW GetShortPathNameW LocalAlloc lstrlenW WaitForSingleObject CreateProcessW GetSystemDirectoryW CreateFileW GetNativeSystemInfo GetCurrentProcess GetVersionExW GlobalMemoryStatusEx GetModuleHandleW GetModuleFileNameW GetLongPathNameW GetLastError GetProcAddress FreeLibrary CloseHandle FormatMessageW GetEnvironmentVariableW GetWindowsDirectoryW LoadLibraryA

ole32

CoTaskMemFree StringFromCLSID

oleaut32

SysStringLen SysAllocStringByteLen SysAllocString VariantClear SysFreeString

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-15_472b4e916c632b0bf4de2cc841ddb0b1_amadey_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

user32

msvcr100

kernel32

ole32

oleaut32

generic