2026-07-12_8c9a5201fdf0b617e06d82a434b7e0f7_elex_redline-stealer_rhadamanthys_smoke-loader_stop_wapomi

General

Target
2026-07-12_8c9a5201fdf0b617e06d82a434b7e0f7_elex_redline-stealer_rhadamanthys_smoke-loader_stop_wapomi
Size 80KB
Sample260712-pkg57sbx7v
SHA256 f9178d683fb2f0e1c0a6222e875876b6f825e939d922661967b263704121a253
MD5 8c9a5201fdf0b617e06d82a434b7e0f7
SHA1 e8c3688f0252254f7fcdb795e1d39adee55b3ac6
SHA512 1654533704aaac286e35f1da2850e36ff3b79b4421c8a89a3c00055169382229a61526318645dbb3d715d8e24819f574e8cc7713727229b53000538858672b4a
SSDEEP 1536:Yg/6/tM8NXDjPX0QWlfGMckTQhoGCq2iW7z:Hk3U8kTQCGCH
TLSH
T1AC838D61B980C073C44A6039441DC7B19F7FBC3126B5C997BB960BBB5F313D1EA2A24A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-12_8c9a5201fdf0b617e06d82a434b7e0f7_elex_redline-stealer_rhadamanthys_smoke-loader_stop_wapomi

File Explorer

2026-07-12_8c9a5201fdf0b617e06d82a434b7e0f7_elex_redline-stealer_rhadamanthys_smoke-loader_stop_wapomi

.exe 80KB

2026-07-12_8c9a5201fdf0b617e06d82a434b7e0f7_elex_redline-stealer_rhadamanthys_smoke-loader_stop_wapomi

IMPHASH ba2c974ed567c90fe365844af978f320
SHA256 f9178d683fb2f0e1c0a6222e875876b6f825e939d922661967b263704121a253
MD5 8c9a5201fdf0b617e06d82a434b7e0f7
SHA1 e8c3688f0252254f7fcdb795e1d39adee55b3ac6
SHA512 1654533704aaac286e35f1da2850e36ff3b79b4421c8a89a3c00055169382229a61526318645dbb3d715d8e24819f574e8cc7713727229b53000538858672b4a
SSDEEP 1536:Yg/6/tM8NXDjPX0QWlfGMckTQhoGCq2iW7z:Hk3U8kTQCGCH
TLSH
T1AC838D61B980C073C44A6039441DC7B19F7FBC3126B5C997BB960BBB5F313D1EA2A24A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

81920

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GenerateConsoleCtrlEvent GetExitCodeProcess WaitForSingleObject CreateProcessA SetConsoleCtrlHandler GetModuleFileNameA EnterCriticalSection LeaveCriticalSection GetModuleHandleW Sleep GetProcAddress ExitProcess GetCommandLineA GetStartupInfoA SetHandleCount GetStdHandle GetFileType DeleteCriticalSection TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetLastError HeapFree HeapAlloc GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId WriteFile LoadLibraryA InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind HeapReAlloc VirtualAlloc GetConsoleCP GetConsoleMode FlushFileBuffers LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetFilePointer HeapSize CloseHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA CompareStringA CompareStringW SetEnvironmentVariableA ReadFile SetEndOfFile GetProcessHeap GetFileAttributesA

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-12_8c9a5201fdf0b617e06d82a434b7e0f7_elex_redline-stealer_rhadamanthys_smoke-loader_stop_wapomi

kernel32

generic