2026-07-10_d9c6843a9737fe45faf6fe2a33f0750d_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader

General

Target
2026-07-10_d9c6843a9737fe45faf6fe2a33f0750d_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader
Size 126KB
Sample260710-vrexbads9k
SHA256 21d7f30fd258f8bdc95227b484c8ac59089ce63d9a50776bbe071bed4121603f
MD5 d9c6843a9737fe45faf6fe2a33f0750d
SHA1 6650228a8f4424dc1d56c9da4928310cfbd86cd7
SHA512 e4ac928a62d85957e6e417359ea585340d683ed416858b4cfef85c09a38583f765db3810177bfafd46be5ea130afc38b80cf50e0511e25120c5bca4d8a812274
SSDEEP 3072:ELLVsFhmRqLOUph/6nwX5c6LsXS5QRNd6y:4LVsFbjS65HISoNd
TLSH
T17EC3C015B685C872E01215B80452D7611B1EFD322BD696CB3BAAB69F4F722C2C33731E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-10_d9c6843a9737fe45faf6fe2a33f0750d_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader

File Explorer

2026-07-10_d9c6843a9737fe45faf6fe2a33f0750d_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader

.exe 126KB

2026-07-10_d9c6843a9737fe45faf6fe2a33f0750d_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader

IMPHASH 3d9aac51c16d5bb81bb736f3d49d9286
SHA256 21d7f30fd258f8bdc95227b484c8ac59089ce63d9a50776bbe071bed4121603f
MD5 d9c6843a9737fe45faf6fe2a33f0750d
SHA1 6650228a8f4424dc1d56c9da4928310cfbd86cd7
SHA512 e4ac928a62d85957e6e417359ea585340d683ed416858b4cfef85c09a38583f765db3810177bfafd46be5ea130afc38b80cf50e0511e25120c5bca4d8a812274
SSDEEP 3072:ELLVsFhmRqLOUph/6nwX5c6LsXS5QRNd6y:4LVsFbjS65HISoNd
TLSH
T17EC3C015B685C872E01215B80452D7611B1EFD322BD696CB3BAAB69F4F722C2C33731E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

5874

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ExitProcess GetFileSize MapViewOfFile UnmapViewOfFile HeapAlloc GetCurrentProcess HeapFree GetProcessHeap Sleep GetModuleFileNameW CreateFileW SetCurrentDirectoryA VirtualAlloc VirtualAllocEx CreateFileMappingW GetModuleFileNameA CloseHandle GetCurrentProcessId LCMapStringW LCMapStringA GetStringTypeW MultiByteToWideChar GetStringTypeA GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW GetProcAddress WriteFile GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId GetLastError InterlockedDecrement HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection LoadLibraryA InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage HeapReAlloc RtlUnwind HeapSize GetLocaleInfoA WideCharToMultiByte

wininet

HttpOpenRequestW HttpSendRequestW InternetConnectW InternetReadFile InternetOpenW HttpQueryInfoW InternetCloseHandle

shlwapi

PathAppendW PathRemoveFileSpecW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-10_d9c6843a9737fe45faf6fe2a33f0750d_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader

kernel32

wininet

shlwapi

generic