2026-07-27_7baa45a45bca8bac224e0b3820e3f970_amadey_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-27_7baa45a45bca8bac224e0b3820e3f970_amadey_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee
Size 13.0MB
Sample260728-akbwvsgl2t
SHA256 3b1d7661c7b7a9890b0d2b7b00e184edd4bb5c7358d7c16535b354e8ebcd0c5f
MD5 7baa45a45bca8bac224e0b3820e3f970
SHA1 1cb13e58636549d0d9f95088ead9c5d59b81c87d
SHA512 4d07f447a3e7948ce19c0a9c6297056566e2497ef9d2cac73cfdaa291be753f0162fc4de5074607569c45d395b05840a81e0d8a0db284fe5592101e6f1159452
SSDEEP 12288:+lraEMM7iLYQH8SwAWbE7Eer5+nmer5+n:+lraERiLYQHNYbE
TLSH
T1F8D6960846A60947DE6AFE74766E091FCEEA6417B05EB31D21E1F039E572E21CD23732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-27_7baa45a45bca8bac224e0b3820e3f970_amadey_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee

File Explorer

2026-07-27_7baa45a45bca8bac224e0b3820e3f970_amadey_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee

.exe 13.0MB

2026-07-27_7baa45a45bca8bac224e0b3820e3f970_amadey_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee

IMPHASH 9b1a200c894929ce96d61dcad12096ce
SHA256 3b1d7661c7b7a9890b0d2b7b00e184edd4bb5c7358d7c16535b354e8ebcd0c5f
MD5 7baa45a45bca8bac224e0b3820e3f970
SHA1 1cb13e58636549d0d9f95088ead9c5d59b81c87d
SHA512 4d07f447a3e7948ce19c0a9c6297056566e2497ef9d2cac73cfdaa291be753f0162fc4de5074607569c45d395b05840a81e0d8a0db284fe5592101e6f1159452
SSDEEP 12288:+lraEMM7iLYQH8SwAWbE7Eer5+nmer5+n:+lraERiLYQHNYbE
TLSH
T1F8D6960846A60947DE6AFE74766E091FCEEA6417B05EB31D21E1F039E572E21CD23732
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

26449

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ContinueDebugEvent LCMapStringW GetProcAddress LocalAlloc GetBinaryTypeW SearchPathA VerifyVersionInfoA ExpandEnvironmentStringsW EndUpdateResourceA FindNextFileW FindFirstVolumeW LocalFlags GlobalFlags CopyFileW CreateActCtxW lstrlenW UpdateResourceW CreateActCtxA DeleteVolumeMountPointW InterlockedExchangeAdd GetCurrentDirectoryW CreateMutexW DeactivateActCtx MoveFileA GetLogicalDriveStringsA ResetEvent InterlockedPushEntrySList CreateMailslotA WriteConsoleInputA QueryDosDeviceA GetTempPathW InterlockedDecrement EnumTimeFormatsW SetFileValidData FindFirstFileA FreeEnvironmentStringsW LocalReAlloc GetTickCount SetLastError GetPrivateProfileStructA CopyFileExA GetTempPathA ReadConsoleInputA CreateDirectoryExA GetConsoleAliasA MoveFileWithProgressA LoadLibraryA GetLastError WideCharToMultiByte DeleteFileA GetStartupInfoW GetModuleHandleA GetCPInfo InterlockedIncrement GetACP GetOEMCP IsValidCodePage GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent SetFilePointer EnterCriticalSection LeaveCriticalSection HeapFree CloseHandle HeapAlloc SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection Sleep ExitProcess WriteFile GetModuleFileNameA GetModuleFileNameW GetEnvironmentStringsW GetCommandLineW HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime RaiseException LCMapStringA MultiByteToWideChar GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers RtlUnwind VirtualAlloc HeapReAlloc InitializeCriticalSectionAndSpinCount WriteConsoleA GetConsoleOutputCP WriteConsoleW ReadFile HeapSize CreateFileA

gdi32

GetCharWidth32A GetCharABCWidthsA SelectObject GetTextFaceW GetBrushOrgEx

winhttp

WinHttpSetCredentials

Name

.text

Size

96KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

70KB

Virtual Size

39.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

111KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

ORGYZzcn

Size

1KB

Virtual Size

1KB

Characteristics

Name

pNjzHCvb

Size

1024B

Virtual Size

1003B

Characteristics

Name

EPTXJCED

Size

9KB

Virtual Size

9KB

Characteristics

Name

QHvZXgeV

Size

512B

Virtual Size

369B

Characteristics

Name

TbRGkmkO

Size

4KB

Virtual Size

4KB

Characteristics

Name

fwgmTxsC

Size

2KB

Virtual Size

1KB

Characteristics

Name

KkfgyDcq

Size

4KB

Virtual Size

4KB

Characteristics

Name

nOUNWuZh

Size

2KB

Virtual Size

1KB

Characteristics

Name

jJLCxQGZ

Size

72KB

Virtual Size

71KB

Characteristics

Name

PGiLuIfK

Size

2KB

Virtual Size

1KB

Characteristics

Name

OEPmIuTG

Size

57KB

Virtual Size

56KB

Characteristics

Name

NPxaOCMO

Size

12.6MB

Virtual Size

1KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-27_7baa45a45bca8bac224e0b3820e3f970_amadey_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee

kernel32

gdi32

winhttp

generic