General
- Target 2026-07-14_3f1b24b17867e8c740b3533e04b52b80_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
- Size 770KB
- Sample260714-epe7asdz3q
- SHA256 9a72985a53ec7a10d6646bbdc0fbc5039bd2e7626a43f26a9fe6b042d21dc2a7
- MD5 3f1b24b17867e8c740b3533e04b52b80
- SHA1 fdebf3dafb957581617d9d6ee3b7fc96e92012b5
- SHA512 07ba013290b6fc4504b58ef6358aa82cf88024521b0086af34b277d428572a7f40a87256b92a29910e2ab8f01a39a13e60cdb01eb9e5a342e1394cb3a58f7f2c
- SSDEEP 12288:3tg61sYZv3zdXSaU4Txv9EiYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7SKS:3u6JB39Sa9T79ijLGQ7t2OaBN0sW4T
- TLSH T17AF412B1B0809031E42B54B285B4DEB009797CF984B0941E37FC3A7D4E737E1966AB9E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-14_3f1b24b17867e8c740b3533e04b52b80_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-14_3f1b24b17867e8c740b3533e04b52b80_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Resource
win11ltsc2024-20260710-en
16 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-14_3f1b24b17867e8c740b3533e04b52b80_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
- Size 770KB
- SHA256 9a72985a53ec7a10d6646bbdc0fbc5039bd2e7626a43f26a9fe6b042d21dc2a7
- MD5 3f1b24b17867e8c740b3533e04b52b80
- SHA1 fdebf3dafb957581617d9d6ee3b7fc96e92012b5
- SHA512 07ba013290b6fc4504b58ef6358aa82cf88024521b0086af34b277d428572a7f40a87256b92a29910e2ab8f01a39a13e60cdb01eb9e5a342e1394cb3a58f7f2c
- SSDEEP 12288:3tg61sYZv3zdXSaU4Txv9EiYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7SKS:3u6JB39Sa9T79ijLGQ7t2OaBN0sW4T
- TLSH T17AF412B1B0809031E42B54B285B4DEB009797CF984B0941E37FC3A7D4E737E1966AB9E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1