2026-06-27_3559ef07616467d0749cfbf9faf22318_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

General

Target
2026-06-27_3559ef07616467d0749cfbf9faf22318_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
Size 12.0MB
Sample260629-kghkcaaz6j
SHA256 6637358fa535ee0b109ec27993795d0fdda5a1bcb784634671a34d70d7f48181
MD5 3559ef07616467d0749cfbf9faf22318
SHA1 736226013619ba41a46fcfe11c6ac20b014086c4
SHA512 f5c7e49d25fb0e3e3f130d29c988c946963785b24ec90047790cfb24f2f1073afbcdebc320227ac628919af1cdb26970c6bdaf7c675402dfc8896c9fb967193a
SSDEEP 6144:s+DLnCQj29e/dCOhIctzibHYALvULoA14444444444444444444444444444444f:s+D7fj2816cteYLoA
TLSH
T1B0C62A785A962D56C3BF527CFE5CBB011DAC9FA2FA38A0156681EDC00013B951CA63DF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-27_3559ef07616467d0749cfbf9faf22318_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

File Explorer

2026-06-27_3559ef07616467d0749cfbf9faf22318_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

.exe 12.0MB

2026-06-27_3559ef07616467d0749cfbf9faf22318_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

IMPHASH 83aec8d33ff1d2ed6e490bde788f9850
SHA256 6637358fa535ee0b109ec27993795d0fdda5a1bcb784634671a34d70d7f48181
MD5 3559ef07616467d0749cfbf9faf22318
SHA1 736226013619ba41a46fcfe11c6ac20b014086c4
SHA512 f5c7e49d25fb0e3e3f130d29c988c946963785b24ec90047790cfb24f2f1073afbcdebc320227ac628919af1cdb26970c6bdaf7c675402dfc8896c9fb967193a
SSDEEP 6144:s+DLnCQj29e/dCOhIctzibHYALvULoA14444444444444444444444444444444f:s+D7fj2816cteYLoA
TLSH
T1B0C62A785A962D56C3BF527CFE5CBB011DAC9FA2FA38A0156681EDC00013B951CA63DF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

22021

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\sifoyaliyena\mez8\ropewuy.pdb

kernel32

GetSystemDefaultLangID InterlockedIncrement VerSetConditionMask GetConsoleAliasA WaitNamedPipeA HeapFree SetComputerNameW GetFileAttributesExA GetModuleHandleW GetConsoleAliasesLengthA TzSpecificLocalTimeToSystemTime GlobalAlloc SetFileShortNameW LoadLibraryW Sleep GetFileAttributesA GetConsoleAliasW GetFileAttributesW WriteConsoleW GetGeoInfoA RaiseException SetLastError GetProcAddress VirtualAlloc SetFirmwareEnvironmentVariableW IsValidCodePage LoadLibraryA WriteConsoleA LocalAlloc AddAtomW FoldStringW GetModuleHandleA CreateMutexA FindNextFileW LCMapStringW GetStartupInfoW MultiByteToWideChar GetLastError ReadFile TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EnterCriticalSection LeaveCriticalSection SetFilePointer ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId InterlockedDecrement HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetStdHandle RtlUnwind GetCPInfo GetACP GetOEMCP WideCharToMultiByte GetConsoleCP GetConsoleMode FlushFileBuffers InitializeCriticalSectionAndSpinCount HeapAlloc HeapReAlloc LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA GetConsoleOutputCP HeapSize CloseHandle CreateFileA

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-27_3559ef07616467d0749cfbf9faf22318_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

kernel32

generic