2026-07-19_2a7b97d88342f4e2c6e4012ad2be6eac_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-19_2a7b97d88342f4e2c6e4012ad2be6eac_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
Size 11.4MB
Sample260720-b4yqeaet3z
SHA256 5f517707e606a91d9dd8e7a55e27e651afe287df779ff1a03c3616ff53b32bc2
MD5 2a7b97d88342f4e2c6e4012ad2be6eac
SHA1 ab0de6bf12e52f9aafbb42f32d8af72f1afdb523
SHA512 138c58b1794810851d026ae59653d19222612345e1d48316d3cf4cc190b815bf61673db3ef1a108736d469a142a5907810a7b444eea19e6161d513269a0e4b75
SSDEEP 196608:mhJ7R18EMmu6puseV4ZJ7Ia4cUW6Hk4Q5aeISlE9bx6wuJ7lHXYOQcDaBcDa+k/6:mhJ7jMmJiOSTQodAm4wug5cOBcO+i7G
TLSH
T11FC63384F193C87AE67A86300A295EF58D737E218BDDD6E77FD068AC4EB15E04232185
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

File Explorer

2026-07-19_2a7b97d88342f4e2c6e4012ad2be6eac_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

.exe 11.4MB

2026-07-19_2a7b97d88342f4e2c6e4012ad2be6eac_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

IMPHASH d619eda1a774da262071361b928bb2e4
SHA256 5f517707e606a91d9dd8e7a55e27e651afe287df779ff1a03c3616ff53b32bc2
MD5 2a7b97d88342f4e2c6e4012ad2be6eac
SHA1 ab0de6bf12e52f9aafbb42f32d8af72f1afdb523
SHA512 138c58b1794810851d026ae59653d19222612345e1d48316d3cf4cc190b815bf61673db3ef1a108736d469a142a5907810a7b444eea19e6161d513269a0e4b75
SSDEEP 196608:mhJ7R18EMmu6puseV4ZJ7Ia4cUW6Hk4Q5aeISlE9bx6wuJ7lHXYOQcDaBcDa+k/6:mhJ7jMmJiOSTQodAm4wug5cOBcO+i7G
TLSH
T11FC63384F193C87AE67A86300A295EF58D737E218BDDD6E77FD068AC4EB15E04232185
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX dump on OEP (original entry point)

Digest

77:2d:4a:76:14:18:37:7d:92:52:a0:b5:5f:9e:80:9b:06:1c:bc:86:b6:a1:7b:a0:c1:bf:9e:36:e3:fc:24:c4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=03345604,CN=Pulsar Process Measurement Ltd,O=Pulsar Process Measurement Ltd,ST=Worcestershire,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Jul 8, 2025

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

Serial Number

97:4f:3f:2c:25:0b:7f:3b:7e:23:41:37:0a:19:c3:2f

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 10, 2023 - Aug 9, 2026

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

11489

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA lstrcpyA lstrcatA lstrlenA GetSystemDirectoryA GetProcAddress GetModuleHandleA _lclose GetModuleFileNameA _lread _llseek _lopen _lwrite _lcreat CreateDirectoryA SetCurrentDirectoryA GetDiskFreeSpaceA GetFileAttributesA CompareStringA DeleteFileA GetTempPathA GetCurrentDirectoryA CloseHandle GetExitCodeProcess GetLastError LocalFree GetCurrentProcess MoveFileExA GetStringTypeW MultiByteToWideChar LCMapStringW HeapReAlloc RtlUnwind HeapSize Sleep RemoveDirectoryA FreeLibrary IsValidCodePage GetOEMCP GetModuleHandleW ExitProcess DecodePointer HeapFree HeapAlloc GetCommandLineA HeapSetInformation GetStartupInfoW InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer LoadLibraryW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement WriteFile GetStdHandle GetModuleFileNameW IsProcessorFeaturePresent HeapCreate FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP

user32

TranslateMessage DispatchMessageA PeekMessageA wsprintfA LoadCursorA SetCursor MessageBoxA MsgWaitForMultipleObjects

advapi32

GetTokenInformation OpenProcessToken

shell32

ShellExecuteExA

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-19_2a7b97d88342f4e2c6e4012ad2be6eac_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

kernel32

user32

advapi32

shell32

generic