2026-07-19_0cf79a36bc0e80d2321f78d1bda78c3f_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

General

Target
2026-07-19_0cf79a36bc0e80d2321f78d1bda78c3f_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 11.0MB
Sample260719-ypsbeady4y
SHA256 ade0277966b19c15cd5b072fd6556c6375825d6e1192fb85a194f4e3595d4e23
MD5 0cf79a36bc0e80d2321f78d1bda78c3f
SHA1 81ffc28465ebc789e682f6f8083dcd86104ca5b9
SHA512 1ef3aa550a3370d39fbae1f9b2baa35b3e44de8d9b3eb594ec16bce32da11ee5b50fbb275e9c3270544c45972d74a0b06d4088f05904a112aced6cc3efdadd4f
SSDEEP 24576:pHL555555555555555555555555555555555555555555555555555555555555H:pH
TLSH
T11EC65C41ABD5CD41F6E14E3274359BE9C277FC82A920A14BE244FF8F2CB23A595A1353
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-19_0cf79a36bc0e80d2321f78d1bda78c3f_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-07-19_0cf79a36bc0e80d2321f78d1bda78c3f_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 11.0MB

2026-07-19_0cf79a36bc0e80d2321f78d1bda78c3f_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH c69428ec8c7b96b0ee501e7dab15951a
SHA256 ade0277966b19c15cd5b072fd6556c6375825d6e1192fb85a194f4e3595d4e23
MD5 0cf79a36bc0e80d2321f78d1bda78c3f
SHA1 81ffc28465ebc789e682f6f8083dcd86104ca5b9
SHA512 1ef3aa550a3370d39fbae1f9b2baa35b3e44de8d9b3eb594ec16bce32da11ee5b50fbb275e9c3270544c45972d74a0b06d4088f05904a112aced6cc3efdadd4f
SSDEEP 24576:pHL555555555555555555555555555555555555555555555555555555555555H:pH
TLSH
T11EC65C41ABD5CD41F6E14E3274359BE9C277FC82A920A14BE244FF8F2CB23A595A1353
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

7843

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\dabesi\xawipi34\kaneweh-n.pdb

kernel32

GetDefaultCommConfigW InterlockedIncrement GetEnvironmentStringsW GetComputerNameW GetConsoleAliasesLengthA GetConsoleTitleA ReadConsoleW SetFileTime GetLocaleInfoW SwitchToFiber FreeConsole ReadProcessMemory GetVersionExW GetConsoleAliasW WriteConsoleW CreateActCtxA GetTempPathW LCMapStringA VerifyVersionInfoW GetStdHandle GetCPInfoExW GetLongPathNameW GetProcAddress VirtualAlloc HeapSize BeginUpdateResourceW AllocConsole WriteProfileSectionA GetFirmwareEnvironmentVariableW EnterCriticalSection SetFileAttributesA FindClose GetAtomNameA LoadLibraryA LocalAlloc DnsHostnameToComputerNameA MoveFileA BeginUpdateResourceA GlobalGetAtomNameW SetConsoleWindowInfo GetModuleFileNameA SetConsoleTitleW LoadLibraryExA GetStringTypeW GetConsoleTitleW GetFileTime PeekConsoleInputA SetCalendarInfoA GetFileInformationByHandle DebugBreak ReadConsoleOutputCharacterW LocalFree EnumSystemLocalesW GetVolumeNameForVolumeMountPointA GetLocaleInfoA GetSystemDefaultLangID HeapAlloc GetCommandLineA GetStartupInfoA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetLastError HeapFree DeleteCriticalSection LeaveCriticalSection VirtualFree HeapReAlloc HeapCreate GetModuleHandleW Sleep ExitProcess WriteFile SetHandleCount GetFileType SetFilePointer CloseHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount RtlUnwind SetStdHandle GetCPInfo GetACP GetOEMCP IsValidCodePage GetConsoleCP GetConsoleMode FlushFileBuffers MultiByteToWideChar LCMapStringW GetStringTypeA WriteConsoleA GetConsoleOutputCP CreateFileA

gdi32

GetCharWidthFloatA

winhttp

WinHttpSetDefaultProxyConfiguration

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-19_0cf79a36bc0e80d2321f78d1bda78c3f_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

kernel32

gdi32

winhttp

generic