2026-07-06_54d3b0375e5e3967c445233e134103b7_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

General

Target
2026-07-06_54d3b0375e5e3967c445233e134103b7_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
Size 70KB
Sample260707-eblrxset4r
SHA256 132c4abf5302171c517087afca28a5a541c3c47f47404894e4ebd3f6f005c52d
MD5 54d3b0375e5e3967c445233e134103b7
SHA1 db00f6e518250bddda76cd43b803dc3567567f54
SHA512 f475d11a20418de46562aa36b29580268eb8464ce65c3ea559f84866c2deb5bdac7293e1ce00e23d3b34b339e76f27397f15c7d4977be9b4be115b2f3a6dbc6d
SSDEEP 768:Bl3mAx9v5OSFWOruZGkXreUK4jYFA4e+M9X4Tl4h0TAshDSJaM+dEnLML:Hm69v5i/XaUK4jYFpe+rlTACnd
TLSH
T11E6328017854C632C82044F0CC6EC2E59F6ADC1162F64D8BBF95BEDE6E71681F62E366
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-06_54d3b0375e5e3967c445233e134103b7_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

File Explorer

2026-07-06_54d3b0375e5e3967c445233e134103b7_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

.exe 70KB

2026-07-06_54d3b0375e5e3967c445233e134103b7_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

IMPHASH 74163037421806f0cf9c27e968112bc2
SHA256 132c4abf5302171c517087afca28a5a541c3c47f47404894e4ebd3f6f005c52d
MD5 54d3b0375e5e3967c445233e134103b7
SHA1 db00f6e518250bddda76cd43b803dc3567567f54
SHA512 f475d11a20418de46562aa36b29580268eb8464ce65c3ea559f84866c2deb5bdac7293e1ce00e23d3b34b339e76f27397f15c7d4977be9b4be115b2f3a6dbc6d
SSDEEP 768:Bl3mAx9v5OSFWOruZGkXreUK4jYFA4e+M9X4Tl4h0TAshDSJaM+dEnLML:Hm69v5i/XaUK4jYFpe+rlTACnd
TLSH
T11E6328017854C632C82044F0CC6EC2E59F6ADC1162F64D8BBF95BEDE6E71681F62E366
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

13051

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentProcess GetVersionExA OpenFile FreeLibrary GetProcAddress LoadLibraryA _lcreat _lclose _lopen GetModuleFileNameA GetModuleHandleA GetCommandLineA SetErrorMode WinExec LCMapStringW LCMapStringA GetStringTypeW MultiByteToWideChar GetStringTypeA GetLocaleInfoA RtlUnwind HeapReAlloc VirtualAlloc HeapAlloc InitializeCriticalSectionAndSpinCount ExitProcess _lwrite GetLastError lstrcatA FormatMessageA LocalFree lstrcpyA GetTempPathA GetWindowsDirectoryA GetTempFileNameA MulDiv lstrlenA _lread _llseek GlobalLock GlobalUnlock GlobalFree GlobalAlloc HeapSize GetStartupInfoA GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent Sleep WriteFile GetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection HeapCreate VirtualFree HeapFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage

user32

wsprintfA ExitWindowsEx CreateWindowExA ShowWindow SetWindowPos UpdateWindow SetTimer LoadIconA LoadCursorA RegisterClassA MessageBoxA DefWindowProcA BeginPaint DrawTextA EndPaint InvalidateRect PostQuitMessage SendMessageA GetDC ReleaseDC GetClientRect

gdi32

GetStockObject CreatePalette SelectPalette RealizePalette GetDeviceCaps CreateFontA StretchDIBits SelectObject SetBkMode SetTextColor TextOutA DeleteObject CreateSolidBrush PatBlt

advapi32

OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-06_54d3b0375e5e3967c445233e134103b7_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

kernel32

user32

gdi32

advapi32

generic