2026-05-16_572baa37c8dc2e774a2617758e6435ac_elex_redline-stealer_smoke-loader_stealc_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-16_572baa37c8dc2e774a2617758e6435ac_elex_redline-stealer_smoke-loader_stealc_tofsee
Size 185KB
Sample260516-rec1eaex2y
SHA256 fef3362e02714edd4f964501213453c19942dba839acad68dc3ace1ec59ec888
MD5 572baa37c8dc2e774a2617758e6435ac
SHA1 2907cf82ec4018e4d178adac40849c7380bdf0c2
SHA512 184963a678361ae3d0ecdc9c33632c348cebcf705cca73111ec0fe3ea8900fb126e388049f52ea1f59c1a9b1632c24382e2c45d05b745921975deaa36519bf38
SSDEEP 3072:d4LZ0t8IcMbmvzEl/ktl9bDrowe+PNuCCcpLlKECHXkzWsV2vR:d41c8IcYGzElCl9bvowe+PAWpLQEYUCr
TLSH
T184045B3575C4C076D9931AB08DF897BAA829F4214BB191CBA7C81F2E5F717C31A31A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-05-16_572baa37c8dc2e774a2617758e6435ac_elex_redline-stealer_smoke-loader_stealc_tofsee

.exe 185KB

2026-05-16_572baa37c8dc2e774a2617758e6435ac_elex_redline-stealer_smoke-loader_stealc_tofsee

IMPHASH 1d92217ed7572f42f07d6ec5f2bc68b1
SHA256 fef3362e02714edd4f964501213453c19942dba839acad68dc3ace1ec59ec888
MD5 572baa37c8dc2e774a2617758e6435ac
SHA1 2907cf82ec4018e4d178adac40849c7380bdf0c2
SHA512 184963a678361ae3d0ecdc9c33632c348cebcf705cca73111ec0fe3ea8900fb126e388049f52ea1f59c1a9b1632c24382e2c45d05b745921975deaa36519bf38
SSDEEP 3072:d4LZ0t8IcMbmvzEl/ktl9bDrowe+PNuCCcpLlKECHXkzWsV2vR:d41c8IcYGzElCl9bvowe+PAWpLQEYUCr
TLSH
T184045B3575C4C076D9931AB08DF897BAA829F4214BB191CBA7C81F2E5F717C31A31A1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

bf:72:d8:cf:16:ac:32:ee:a1:ea:eb:ff:c7:8e:3f:9c:73:9e:58:92:75:13:b0:34:8f:a7:5a:43:bd:ec:15:b4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=SEIKO EPSON CORPORATION,OU=セイコーエプソン株式会社,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

Chains

May 23, 2025

CN=SEIKO EPSON CORPORATION,OU=セイコーエプソン株式会社,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=SEIKO EPSON CORPORATION,OU=セイコーエプソン株式会社,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

Serial Number

0f:34:8d:af:0a:cf:04:61:e4:d4:a3:9d:05:ad:27:41

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 4, 2024 - Sep 4, 2025

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Serial Number

01:00:0b:20:05:b3:94:07:62:db:3e:36:79:94:9b:a9

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 11, 2025 - Dec 10, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

66511

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEvent GetModuleFileNameW CloseHandle OpenMutexW WaitForSingleObject CreateEventW Sleep GetLastError ResumeThread GetCurrentThreadId GetACP MultiByteToWideChar WideCharToMultiByte SystemTimeToTzSpecificLocalTime GetSystemTime GetTimeZoneInformation GetCurrentProcessId InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetModuleHandleW CreateFileW SetLastError CreateMailslotW WriteFile GetMailslotInfo ReadFile CompareStringW GetCommandLineA HeapSetInformation GetStartupInfoW HeapFree HeapAlloc RtlUnwind RaiseException EncodePointer DecodePointer ExitThread CreateThread GetSystemTimeAsFileTime SetUnhandledExceptionFilter GetProcAddress ExitProcess GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement HeapCreate QueryPerformanceCounter GetTickCount UnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess IsProcessorFeaturePresent GetCPInfo GetOEMCP IsValidCodePage HeapSize GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer LoadLibraryW LCMapStringW GetStringTypeW HeapReAlloc SetStdHandle WriteConsoleW SetEnvironmentVariableA

shell32

ShellExecuteW

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-16_572baa37c8dc2e774a2617758e6435ac_elex_redline-stealer_smoke-loader_stealc_tofsee

kernel32

shell32

generic