2026-06-01_1d0bdfc893d6249c50174379111ffdf7_amadey_elex_graftor_redline-stealer_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-01_1d0bdfc893d6249c50174379111ffdf7_amadey_elex_graftor_redline-stealer_rhadamanthys_smoke-loader_stop
Size 888KB
Sample260601-baeqfac12m
SHA256 1e47e7943c8a3fba9f7a1b9639ce330bee7b1e15754fd32d93ffa4e6acd4ebcb
MD5 1d0bdfc893d6249c50174379111ffdf7
SHA1 54df03d4b57bd10b7086ec3d11af17011615272d
SHA512 8a0a37af26b0eb6e6fac2ce405791516936ac49dda62a44ad11f580e090f55664415fa43b9f3380fad43f2ba0a78560e4635f82aba235d0f97daadacffd05293
SSDEEP 24576:wkIT2GNzn++GpF7usg5l7figQ5DXByXcfa:nITZznMFqsg5Q7DXB9a
TLSH
T1401512C0BBC1C0B3D42A643A89D9CB756775743B1B699AE367681BB11D023905B3B3CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-06-01_1d0bdfc893d6249c50174379111ffdf7_amadey_elex_graftor_redline-stealer_rhadamanthys_smoke-loader_stop

File Explorer

2026-06-01_1d0bdfc893d6249c50174379111ffdf7_amadey_elex_graftor_redline-stealer_rhadamanthys_smoke-loader_stop

.exe 888KB

2026-06-01_1d0bdfc893d6249c50174379111ffdf7_amadey_elex_graftor_redline-stealer_rhadamanthys_smoke-loader_stop

IMPHASH f37295a71096ccb7f8bd10df4a9c36a8
SHA256 1e47e7943c8a3fba9f7a1b9639ce330bee7b1e15754fd32d93ffa4e6acd4ebcb
MD5 1d0bdfc893d6249c50174379111ffdf7
SHA1 54df03d4b57bd10b7086ec3d11af17011615272d
SHA512 8a0a37af26b0eb6e6fac2ce405791516936ac49dda62a44ad11f580e090f55664415fa43b9f3380fad43f2ba0a78560e4635f82aba235d0f97daadacffd05293
SSDEEP 24576:wkIT2GNzn++GpF7usg5l7figQ5DXByXcfa:nITZznMFqsg5Q7DXB9a
TLSH
T1401512C0BBC1C0B3D42A643A89D9CB756775743B1B699AE367681BB11D023905B3B3CE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

cf:d9:0c:53:d3:88:17:fc:6c:85:6c:29:91:4b:d1:5b:2c:64:3b:1b

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=KONICA MINOLTA\, INC.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Printer Controller Development Division,O=KONICA MINOLTA\, INC.,L=Hachioji-shi,ST=Tokyo,C=JP

Chains

May 8, 2013

CN=KONICA MINOLTA\, INC.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Printer Controller Development Division,O=KONICA MINOLTA\, INC.,L=Hachioji-shi,ST=Tokyo,C=JP

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=KONICA MINOLTA\, INC.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Printer Controller Development Division,O=KONICA MINOLTA\, INC.,L=Hachioji-shi,ST=Tokyo,C=JP

Serial Number

51:ae:0b:22:a1:25:b0:23:e3:2a:05:67:44:36:c6:5b

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2013 - Apr 18, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

39754

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleA CreateToolhelp32Snapshot GetVersionExA CloseHandle GetTempPathA SetErrorMode CopyFileA GetModuleFileNameA GetProcAddress GetLastError ReadFile Thread32Next CreateProcessA Sleep Thread32First OpenThread OpenProcess WriteFile ExpandEnvironmentStringsA GetProcessHeap HeapFree GetCurrentProcess Process32First GetSystemDirectoryA Module32First Process32Next Module32Next SetFilePointer GetTickCount GetFileAttributesA CreateMutexA WaitForSingleObject TerminateThread ExitThread GetExitCodeThread CreateThread SetThreadContext TerminateProcess DuplicateHandle GetFileTime SetFileAttributesA SetFileTime HeapAlloc GetModuleHandleW ExitProcess GetCommandLineA GetStartupInfoA UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId GetStdHandle DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LoadLibraryA InitializeCriticalSectionAndSpinCount WideCharToMultiByte GetConsoleCP GetConsoleMode FlushFileBuffers RtlUnwind SetHandleCount GetFileType RaiseException FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime VirtualAlloc HeapReAlloc LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle SetEndOfFile lstrlenA GetFileSize CreateFileA GetComputerNameA

user32

EnumChildWindows GetForegroundWindow SendMessageA GetWindowRect GetClassNameA WaitForInputIdle

advapi32

CryptReleaseContext CryptAcquireContextA CryptCreateHash CryptGetHashParam CryptDestroyHash CryptHashData LookupPrivilegeValueA GetUserNameA LookupAccountSidA GetTokenInformation OpenProcessToken AdjustTokenPrivileges

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

psapi

GetModuleFileNameExA

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-01_1d0bdfc893d6249c50174379111ffdf7_amadey_elex_graftor_redline-stealer_rhadamanthys_smoke-loader_stop

PE Signature issue

kernel32

user32

advapi32

version

psapi

generic