2026-04-26_1baa261a97b4d3c89e2deab7d0ed31db_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

General

Target
2026-04-26_1baa261a97b4d3c89e2deab7d0ed31db_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
Size 1.2MB
Sample260426-ftam2ses91
SHA256 dac84a9605faefffe02657a1ef3c1758de782c4fe9e1dd8a2085c9779e83c5a8
MD5 1baa261a97b4d3c89e2deab7d0ed31db
SHA1 bf0167568f12fb4d8e104937cb86077a33c86837
SHA512 bd30951525499d3d70a90bb85b2c039e0fa72922f90485fe45718c47909021af9bbf4e4f9ed99c94f45526b99c3a33b44a9f5379dd495eb94aa39ac07d682760
SSDEEP 12288:9Kf8xc6qHLo84QTUIU9O5NZUkwz2dzdICFjV+68Jv:9KExc1lTUl9O5A7LXv
TLSH
T1BD458306BBFAC965E4BF1B743DA9D3C925F3FE658D018B2B7189034E0CB56004D61A7A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-26_1baa261a97b4d3c89e2deab7d0ed31db_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

File Explorer

2026-04-26_1baa261a97b4d3c89e2deab7d0ed31db_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

.exe 1.2MB

2026-04-26_1baa261a97b4d3c89e2deab7d0ed31db_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

IMPHASH eb816bdcb34642ae497d2f004d3c6914
SHA256 dac84a9605faefffe02657a1ef3c1758de782c4fe9e1dd8a2085c9779e83c5a8
MD5 1baa261a97b4d3c89e2deab7d0ed31db
SHA1 bf0167568f12fb4d8e104937cb86077a33c86837
SHA512 bd30951525499d3d70a90bb85b2c039e0fa72922f90485fe45718c47909021af9bbf4e4f9ed99c94f45526b99c3a33b44a9f5379dd495eb94aa39ac07d682760
SSDEEP 12288:9Kf8xc6qHLo84QTUIU9O5NZUkwz2dzdICFjV+68Jv:9KExc1lTUl9O5A7LXv
TLSH
T1BD458306BBFAC965E4BF1B743DA9D3C925F3FE658D018B2B7189034E0CB56004D61A7A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

8893

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\zodogizupise\xilehupo63\map.pdb

kernel32

lstrlenA EnumDateFormatsExW WriteConsoleOutputW InterlockedIncrement GetConsoleAliasA InterlockedDecrement WritePrivateProfileSectionA GetSystemWindowsDirectoryW GetEnvironmentStringsW GetUserDefaultLCID WriteConsoleInputA SetEvent GetConsoleAliasesLengthA GetConsoleTitleA CreateActCtxW InitializeCriticalSection GetConsoleCP GlobalAlloc DnsHostnameToComputerNameW lstrcpynW SetConsoleCursorPosition GetFileAttributesW HeapQueryInformation IsBadWritePtr GetCompressedFileSizeA GetSystemDirectoryA CreateFileW lstrcatA GetACP GetVolumePathNameA FlushFileBuffers VerifyVersionInfoW InterlockedExchange GetLastError GetProcAddress PeekConsoleInputW CreateTimerQueueTimer LocalLock GetConsoleDisplayMode EnterCriticalSection SetTimerQueueTimer GetLocalTime WriteConsoleA DeleteTimerQueue CreateTapePartition BeginUpdateResourceA GlobalGetAtomNameW WaitForMultipleObjects SetEnvironmentVariableA GetModuleFileNameA GetModuleHandleA FindFirstVolumeA EndUpdateResourceA ReadConsoleInputW GetCurrentProcessId AreFileApisANSI LCMapStringW FillConsoleOutputCharacterA GetComputerNameA UnhandledExceptionFilter SetUnhandledExceptionFilter HeapReAlloc HeapAlloc GetModuleHandleW Sleep ExitProcess GetCommandLineA GetStartupInfoA WriteFile GetStdHandle TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId DeleteCriticalSection LeaveCriticalSection HeapCreate VirtualFree HeapFree VirtualAlloc TerminateProcess GetCurrentProcess IsDebuggerPresent LoadLibraryA InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime RaiseException GetCPInfo GetOEMCP IsValidCodePage RtlUnwind HeapSize GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW LCMapStringA

user32

RealGetWindowClassA

advapi32

AdjustTokenGroups

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-26_1baa261a97b4d3c89e2deab7d0ed31db_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

kernel32

user32

advapi32

generic