2026-06-03_a8ef5e75598274e80ce1f74df71831b2_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop

General

Target
2026-06-03_a8ef5e75598274e80ce1f74df71831b2_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop
Size 126KB
Sample260603-shcdqaas7v
SHA256 d0c7c5cee91d9e0a504a21c884419733ecee51628058baf0c3412636ffee6a1d
MD5 a8ef5e75598274e80ce1f74df71831b2
SHA1 6753e2f9eb9cc4d6758e6cca58185553652a4a06
SHA512 a556599b98af1895fe7daaa2f8c18e58a47f070d959e4accefb996acdc695f1b25093b3c74615663fe6a27626fb09057cb8ff4979fe1d854d49b5526e7524183
SSDEEP 1536:ELLlfvrV9z0RuxR53i6EBXlLOUph/qaynwX5/R2E7iFgdBfV+TDLBFb+RNTJPkn0:ELLVpImRqLOUph/6nwX5c6LsX6RNd6
TLSH
T15CC3C015BA85C872E01214F81452D7611B1AED222BD556CB3FB9BAAF5F712C2C33731E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-03_a8ef5e75598274e80ce1f74df71831b2_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop

File Explorer

2026-06-03_a8ef5e75598274e80ce1f74df71831b2_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop

.exe 126KB

2026-06-03_a8ef5e75598274e80ce1f74df71831b2_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop

IMPHASH 3d9aac51c16d5bb81bb736f3d49d9286
SHA256 d0c7c5cee91d9e0a504a21c884419733ecee51628058baf0c3412636ffee6a1d
MD5 a8ef5e75598274e80ce1f74df71831b2
SHA1 6753e2f9eb9cc4d6758e6cca58185553652a4a06
SHA512 a556599b98af1895fe7daaa2f8c18e58a47f070d959e4accefb996acdc695f1b25093b3c74615663fe6a27626fb09057cb8ff4979fe1d854d49b5526e7524183
SSDEEP 1536:ELLlfvrV9z0RuxR53i6EBXlLOUph/qaynwX5/R2E7iFgdBfV+TDLBFb+RNTJPkn0:ELLVpImRqLOUph/6nwX5c6LsX6RNd6
TLSH
T15CC3C015BA85C872E01214F81452D7611B1AED222BD556CB3FB9BAAF5F712C2C33731E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

5874

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ExitProcess GetFileSize MapViewOfFile UnmapViewOfFile HeapAlloc GetCurrentProcess HeapFree GetProcessHeap Sleep GetModuleFileNameW CreateFileW SetCurrentDirectoryA VirtualAlloc VirtualAllocEx CreateFileMappingW GetModuleFileNameA CloseHandle GetCurrentProcessId LCMapStringW LCMapStringA GetStringTypeW MultiByteToWideChar GetStringTypeA GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW GetProcAddress WriteFile GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId GetLastError InterlockedDecrement HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection LoadLibraryA InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage HeapReAlloc RtlUnwind HeapSize GetLocaleInfoA WideCharToMultiByte

wininet

HttpOpenRequestW HttpSendRequestW InternetConnectW InternetReadFile InternetOpenW HttpQueryInfoW InternetCloseHandle

shlwapi

PathAppendW PathRemoveFileSpecW

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-03_a8ef5e75598274e80ce1f74df71831b2_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop

kernel32

wininet

shlwapi

generic