2026-07-18_d2e17e89e185835f22a0420203e14250_amadey_elex_http-browser_neshta_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-18_d2e17e89e185835f22a0420203e14250_amadey_elex_http-browser_neshta_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
Size 2.6MB
Sample260718-mb94hsf15j
SHA256 ebfccf67827fbd55ff878d9d8d9d9cecb5e5911ca412151b5a40d058d3798cb1
MD5 d2e17e89e185835f22a0420203e14250
SHA1 6abe2eb180471c49044655b3b7ebb05af29998ef
SHA512 ca5f92e589da45d3f28f94034123839d09b4872fd3f3098a77219351fa2d481beb6264c24c789e408a9933690d842b8fc21f36ea036af49675680f640ca85da4
SSDEEP 49152:gWjTpLElrHaO6xcG6O5GJGNpoQVgK2Gd9z7hlSitNqzhSMlGlOFpuSvaY/bGokS/:pLElr69xYOMqfVgKDd9z7hlHtNqia7a2
TLSH
T118C53341738690F2D5BA0EF8AC59BA66562737717B9091D77B58BCB90E703C3013B28E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-18_d2e17e89e185835f22a0420203e14250_amadey_elex_http-browser_neshta_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-07-18_d2e17e89e185835f22a0420203e14250_amadey_elex_http-browser_neshta_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

.exe 2.6MB

2026-07-18_d2e17e89e185835f22a0420203e14250_amadey_elex_http-browser_neshta_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

IMPHASH ad7300b4c786bf900b909156a493b9c3
SHA256 ebfccf67827fbd55ff878d9d8d9d9cecb5e5911ca412151b5a40d058d3798cb1
MD5 d2e17e89e185835f22a0420203e14250
SHA1 6abe2eb180471c49044655b3b7ebb05af29998ef
SHA512 ca5f92e589da45d3f28f94034123839d09b4872fd3f3098a77219351fa2d481beb6264c24c789e408a9933690d842b8fc21f36ea036af49675680f640ca85da4
SSDEEP 49152:gWjTpLElrHaO6xcG6O5GJGNpoQVgK2Gd9z7hlSitNqzhSMlGlOFpuSvaY/bGokS/:pLElr69xYOMqfVgKDd9z7hlHtNqia7a2
TLSH
T118C53341738690F2D5BA0EF8AC59BA66562737717B9091D77B58BCB90E703C3013B28E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

d2:59:77:c4:29:60:7e:98:9b:77:be:b1:4f:ce:fe:81:b6:c6:3b:ce

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=Production CS,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jul 18, 2014

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 7, 2012 - Jun 6, 2022

Subject

Serial Number

66:61:aa:ae:86:11:da:90:cf:de:b8:fb:6e:50:ee:98

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 30, 2013 - Jul 25, 2015

Minor OS version

Major OS version

Entry point

4820

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

g:\Acro_root_api\Main\code\build\win\results\Release\info\sea.pdb

shlwapi

PathAppendW

shell32

ShellExecuteExW SHFileOperationW

kernel32

TlsAlloc ExitProcess GetCommandLineW GetTempFileNameW SetFilePointer HeapAlloc HeapFree CreateDirectoryW WaitForSingleObject GetModuleHandleW GetProcessHeap WriteFile GetExitCodeProcess GetFileAttributesW ReadFile GetModuleFileNameW CreateFileW MultiByteToWideChar GetTempPathW GetLastError GetProcAddress CloseHandle DeleteFileW CreateThread GetCommandLineA GetStartupInfoA HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc SetUnhandledExceptionFilter Sleep GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType TlsGetValue RaiseException TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent InitializeCriticalSectionAndSpinCount RtlUnwind LoadLibraryA GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize GetLocaleInfoA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

user32

TranslateMessage DispatchMessageW GetMessageW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-18_d2e17e89e185835f22a0420203e14250_amadey_elex_http-browser_neshta_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

PE Signature issue

shlwapi

shell32

kernel32

user32

generic