2026-07-02_a76ef331e8f9136783d281c3884b3f8a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

General

Target
2026-07-02_a76ef331e8f9136783d281c3884b3f8a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
Size 10.4MB
Sample260702-vd7eeaas2w
SHA256 7c587ad63305a2ee7c6449fc35b01fda6dc45ad84ee379b55baa7ce71473dc7b
MD5 a76ef331e8f9136783d281c3884b3f8a
SHA1 009619d99d28acc20fe7448637bced142b9149f3
SHA512 2a99defcc1b1c5c8cead78065a645ac7c14b655e377c11e7db176a65a66982767a08738d6fa60dc8e9f0b3cdedf2e1c688b8e5535a2151e347eea9c3d7bd07fd
SSDEEP 6144:H+DLnCQj29e/dCOhIctzibHYALvULoA14444444444444444444444444444444r:H+D7fj2816cteYLoA
TLSH
T194B62A785A962D56C3BF527CFE5CBB011DAC9FA2FA38A0156681EDC00013B951CA63DF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-02_a76ef331e8f9136783d281c3884b3f8a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

File Explorer

2026-07-02_a76ef331e8f9136783d281c3884b3f8a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

.exe 10.4MB

2026-07-02_a76ef331e8f9136783d281c3884b3f8a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

IMPHASH 83aec8d33ff1d2ed6e490bde788f9850
SHA256 7c587ad63305a2ee7c6449fc35b01fda6dc45ad84ee379b55baa7ce71473dc7b
MD5 a76ef331e8f9136783d281c3884b3f8a
SHA1 009619d99d28acc20fe7448637bced142b9149f3
SHA512 2a99defcc1b1c5c8cead78065a645ac7c14b655e377c11e7db176a65a66982767a08738d6fa60dc8e9f0b3cdedf2e1c688b8e5535a2151e347eea9c3d7bd07fd
SSDEEP 6144:H+DLnCQj29e/dCOhIctzibHYALvULoA14444444444444444444444444444444r:H+D7fj2816cteYLoA
TLSH
T194B62A785A962D56C3BF527CFE5CBB011DAC9FA2FA38A0156681EDC00013B951CA63DF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

22021

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\sifoyaliyena\mez8\ropewuy.pdb

kernel32

GetSystemDefaultLangID InterlockedIncrement VerSetConditionMask GetConsoleAliasA WaitNamedPipeA HeapFree SetComputerNameW GetFileAttributesExA GetModuleHandleW GetConsoleAliasesLengthA TzSpecificLocalTimeToSystemTime GlobalAlloc SetFileShortNameW LoadLibraryW Sleep GetFileAttributesA GetConsoleAliasW GetFileAttributesW WriteConsoleW GetGeoInfoA RaiseException SetLastError GetProcAddress VirtualAlloc SetFirmwareEnvironmentVariableW IsValidCodePage LoadLibraryA WriteConsoleA LocalAlloc AddAtomW FoldStringW GetModuleHandleA CreateMutexA FindNextFileW LCMapStringW GetStartupInfoW MultiByteToWideChar GetLastError ReadFile TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EnterCriticalSection LeaveCriticalSection SetFilePointer ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId InterlockedDecrement HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetStdHandle RtlUnwind GetCPInfo GetACP GetOEMCP WideCharToMultiByte GetConsoleCP GetConsoleMode FlushFileBuffers InitializeCriticalSectionAndSpinCount HeapAlloc HeapReAlloc LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA GetConsoleOutputCP HeapSize CloseHandle CreateFileA

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-02_a76ef331e8f9136783d281c3884b3f8a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

kernel32

generic