2026-06-30_b698d2fb17fe381dbab1eaa1ff24e47d_elex_redline-stealer_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-30_b698d2fb17fe381dbab1eaa1ff24e47d_elex_redline-stealer_rhadamanthys_stop
Size 1.3MB
Sample260701-dp72mse19v
SHA256 e84b80cfd58db8472e0a3f97251beca5385d0457bd2cbebed438c36b641d8d77
MD5 b698d2fb17fe381dbab1eaa1ff24e47d
SHA1 1729aef276a27b9b6b3e68e2d049b18643c84842
SHA512 8d01781cb40fce0459aa316fdb6eb061b7d68fb457b0fb2d9587b8c237dddc4167c49cdb923d57702c6951497d0b2d0c77622afb550498dc48c819ffe6efee5d
SSDEEP 24576:nngqSf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nngqSfLNiXicJFFRGNzj3
TLSH
T137551212B6809073D5672835B63DC4649B297C300778D983F2442F6F7EB6BE68B362D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-30_b698d2fb17fe381dbab1eaa1ff24e47d_elex_redline-stealer_rhadamanthys_stop

File Explorer

2026-06-30_b698d2fb17fe381dbab1eaa1ff24e47d_elex_redline-stealer_rhadamanthys_stop

.exe 1.3MB

2026-06-30_b698d2fb17fe381dbab1eaa1ff24e47d_elex_redline-stealer_rhadamanthys_stop

IMPHASH 35c1823c80e6470f38f361b092bb658c
SHA256 e84b80cfd58db8472e0a3f97251beca5385d0457bd2cbebed438c36b641d8d77
MD5 b698d2fb17fe381dbab1eaa1ff24e47d
SHA1 1729aef276a27b9b6b3e68e2d049b18643c84842
SHA512 8d01781cb40fce0459aa316fdb6eb061b7d68fb457b0fb2d9587b8c237dddc4167c49cdb923d57702c6951497d0b2d0c77622afb550498dc48c819ffe6efee5d
SSDEEP 24576:nngqSf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nngqSfLNiXicJFFRGNzj3
TLSH
T137551212B6809073D5672835B63DC4649B297C300778D983F2442F6F7EB6BE68B362D2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12605

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Documents and Settings\Administrator\My Documents\Visual Studio 2008\Projects\SmadavUpdater1472\Release\SmadavSecondaryUpdater.pdb

kernel32

FlushFileBuffers CreateFileA ReadFile WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle InitializeCriticalSectionAndSpinCount LoadLibraryA GetLocaleInfoA OutputDebugStringW GetSystemTime DeleteFileW CloseHandle WriteFile CreateFileW RtlUnwind GetFileAttributesW GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA HeapReAlloc VirtualAlloc HeapSize LeaveCriticalSection EnterCriticalSection GetConsoleMode GetConsoleCP WideCharToMultiByte SetFilePointer GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetLastError MultiByteToWideChar GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc RaiseException HeapFree GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCPInfo GetACP GetOEMCP IsValidCodePage Sleep ExitProcess GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection HeapCreate VirtualFree

user32

TranslateAcceleratorW TranslateMessage DispatchMessageW LoadIconW GetMessageW RegisterClassExW CreateWindowExW ShowWindow UpdateWindow SetTimer LoadAcceleratorsW LoadStringW PostQuitMessage LoadCursorW EndDialog EndPaint BeginPaint DefWindowProcW MessageBoxW DestroyWindow DialogBoxParamW

advapi32

RegOpenKeyExW CryptReleaseContext CryptDestroyHash CryptVerifySignatureW CryptHashData CryptCreateHash CryptImportKey CryptAcquireContextW RegQueryValueExW

shell32

ord680 ShellExecuteW SHGetFolderPathW

wininet

InternetCheckConnectionW InternetCloseHandle InternetReadFile InternetOpenUrlW InternetOpenW

winhttp

WinHttpConnect WinHttpCloseHandle WinHttpReadData WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpSendRequest WinHttpOpen WinHttpOpenRequest

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-30_b698d2fb17fe381dbab1eaa1ff24e47d_elex_redline-stealer_rhadamanthys_stop

kernel32

user32

advapi32

shell32

wininet

winhttp

generic