2026-07-16_6ea941da8859b1af60e8f0dd1d9b5c3a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-16_6ea941da8859b1af60e8f0dd1d9b5c3a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
Size 65KB
Sample260716-dchafsfs2x
SHA256 4eec37bf664ba1c3b3575f411b6a1f58aea7be256c8f474b6090b0248e858d0f
MD5 6ea941da8859b1af60e8f0dd1d9b5c3a
SHA1 c0f6f118152fd74d3bdc5d4a9ddc60709e988c1e
SHA512 8bfb719d2ac461dd9bfdc671933a51dc140d56bcc2decf18012ccf16b1cd114293dfa58463c30723b2070140a342722ea8f37f237ea702378f11d0fabbc8d8a0
SSDEEP 768:b00UHf57LnWykdBdusOAL/2DH9owR97k9/l4ElXYWFoHiPI6zDw5T6cBJhFd/B5C:b00URPnKfZrT2DawRR8JfP3QZB355B/E
TLSH
T1A9639E577890C4B2D80460B41826C6929F6FAD2147B5C0C7BB993E7E9F323DB993934E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-16_6ea941da8859b1af60e8f0dd1d9b5c3a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

File Explorer

2026-07-16_6ea941da8859b1af60e8f0dd1d9b5c3a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

.exe 65KB

2026-07-16_6ea941da8859b1af60e8f0dd1d9b5c3a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

IMPHASH 3ce527d19d124ee8e90816b89714febc
SHA256 4eec37bf664ba1c3b3575f411b6a1f58aea7be256c8f474b6090b0248e858d0f
MD5 6ea941da8859b1af60e8f0dd1d9b5c3a
SHA1 c0f6f118152fd74d3bdc5d4a9ddc60709e988c1e
SHA512 8bfb719d2ac461dd9bfdc671933a51dc140d56bcc2decf18012ccf16b1cd114293dfa58463c30723b2070140a342722ea8f37f237ea702378f11d0fabbc8d8a0
SSDEEP 768:b00UHf57LnWykdBdusOAL/2DH9owR97k9/l4ElXYWFoHiPI6zDw5T6cBJhFd/B5C:b00URPnKfZrT2DawRR8JfP3QZB355B/E
TLSH
T1A9639E577890C4B2D80460B41826C6929F6FAD2147B5C0C7BB993E7E9F323DB993934E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21363

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileSize CreateFileA WriteFile SetFileAttributesA GetModuleHandleA GetCurrentProcess WideCharToMultiByte CreateMutexA GetLocalTime GetSystemDirectoryA IsBadStringPtrA HeapSize GetLocaleInfoA GetStringTypeW GetStringTypeA ReadFile MultiByteToWideChar LCMapStringA HeapReAlloc VirtualAlloc HeapAlloc InitializeCriticalSectionAndSpinCount EnterCriticalSection LeaveCriticalSection IsValidCodePage GetOEMCP GetACP GetCPInfo GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter HeapFree VirtualFree HeapCreate InterlockedDecrement SetLastError InterlockedIncrement TlsFree TlsSetValue TlsAlloc TlsGetValue DeleteCriticalSection GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings CloseHandle CompareStringA ExitProcess GetVersionExA GlobalMemoryStatus GetComputerNameA GetLastError GetCurrentThreadId GetShortPathNameA lstrcmpiA LoadLibraryA FreeLibrary GetProcAddress DeleteFileA GetFileAttributesA GetTempPathA GetWindowsDirectoryA lstrcpyA lstrcatA lstrlenA IsBadReadPtr IsBadWritePtr CreateThread lstrcpynA GetCommandLineA LocalAlloc LocalFree WaitForSingleObject GetTickCount Sleep GetModuleFileNameA LCMapStringW FreeEnvironmentStringsA GetStdHandle GetModuleHandleW RtlUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetStartupInfoA

user32

OpenInputDesktop GetUserObjectInformationA CloseDesktop wsprintfA wvsprintfA PeekMessageA DispatchMessageA TranslateMessage

advapi32

StartServiceCtrlDispatcherA CreateServiceA StartServiceA RegOpenKeyA RegCreateKeyA RegSetValueExA RegDeleteValueA RegOpenKeyExA RegQueryValueExA RegCloseKey RegisterServiceCtrlHandlerA OpenSCManagerA OpenServiceA ControlService DeleteService CloseServiceHandle SetServiceStatus GetUserNameA

shell32

ShellExecuteA

ws2_32

gethostbyaddr WSAGetLastError WSAEnumNetworkEvents WSAStartup WSACleanup WSACloseEvent getpeername ntohs send recv inet_addr closesocket gethostbyname htons connect inet_ntoa WSACreateEvent socket WSAEventSelect WSAWaitForMultipleEvents

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-16_6ea941da8859b1af60e8f0dd1d9b5c3a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

kernel32

user32

advapi32

shell32

ws2_32

generic