2026-07-27_582c65094d3ec6612bf5c26636c04d9b_amadey_elex_graftor_redline-stealer_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-27_582c65094d3ec6612bf5c26636c04d9b_amadey_elex_graftor_redline-stealer_rhadamanthys_smoke-loader_stop
Size 3.1MB
Sample260728-amsbmathpd
SHA256 c9bbd81aee984aadd7116de70d9a40348036aaabc9feac95298b78d902088bb0
MD5 582c65094d3ec6612bf5c26636c04d9b
SHA1 27a0e4e2174d339a48688615394da7e0a337ac50
SHA512 ba014471e2ca1c432e19349b6442b164f673e1451888584b3efd124f0c2483fcf3c36d5616a5779bb4df383e931b23fa8fc846a0e551048283374872ef4eda95
SSDEEP 98304:rErqqsg5GDXBtgazgBAM4gyQVSrfiTpYRX:rErq6GfgazRgypDiTi
TLSH
T1C8E5138227000AB7D42B96F5D175F77700225E2E31AA5E931D74BE263633093DE279EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-27_582c65094d3ec6612bf5c26636c04d9b_amadey_elex_graftor_redline-stealer_rhadamanthys_smoke-loader_stop

File Explorer

2026-07-27_582c65094d3ec6612bf5c26636c04d9b_amadey_elex_graftor_redline-stealer_rhadamanthys_smoke-loader_stop

.exe 3.1MB

2026-07-27_582c65094d3ec6612bf5c26636c04d9b_amadey_elex_graftor_redline-stealer_rhadamanthys_smoke-loader_stop

IMPHASH f37295a71096ccb7f8bd10df4a9c36a8
SHA256 c9bbd81aee984aadd7116de70d9a40348036aaabc9feac95298b78d902088bb0
MD5 582c65094d3ec6612bf5c26636c04d9b
SHA1 27a0e4e2174d339a48688615394da7e0a337ac50
SHA512 ba014471e2ca1c432e19349b6442b164f673e1451888584b3efd124f0c2483fcf3c36d5616a5779bb4df383e931b23fa8fc846a0e551048283374872ef4eda95
SSDEEP 98304:rErqqsg5GDXBtgazgBAM4gyQVSrfiTpYRX:rErq6GfgazRgypDiTi
TLSH
T1C8E5138227000AB7D42B96F5D175F77700225E2E31AA5E931D74BE263633093DE279EB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

39754

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleA CreateToolhelp32Snapshot GetVersionExA CloseHandle GetTempPathA SetErrorMode CopyFileA GetModuleFileNameA GetProcAddress GetLastError ReadFile Thread32Next CreateProcessA Sleep Thread32First OpenThread OpenProcess WriteFile ExpandEnvironmentStringsA GetProcessHeap HeapFree GetCurrentProcess Process32First GetSystemDirectoryA Module32First Process32Next Module32Next SetFilePointer GetTickCount GetFileAttributesA CreateMutexA WaitForSingleObject TerminateThread ExitThread GetExitCodeThread CreateThread SetThreadContext TerminateProcess DuplicateHandle GetFileTime SetFileAttributesA SetFileTime HeapAlloc GetModuleHandleW ExitProcess GetCommandLineA GetStartupInfoA UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId GetStdHandle DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LoadLibraryA InitializeCriticalSectionAndSpinCount WideCharToMultiByte GetConsoleCP GetConsoleMode FlushFileBuffers RtlUnwind SetHandleCount GetFileType RaiseException FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime VirtualAlloc HeapReAlloc LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle SetEndOfFile lstrlenA GetFileSize CreateFileA GetComputerNameA

user32

EnumChildWindows GetForegroundWindow SendMessageA GetWindowRect GetClassNameA WaitForInputIdle

advapi32

CryptReleaseContext CryptAcquireContextA CryptCreateHash CryptGetHashParam CryptDestroyHash CryptHashData LookupPrivilegeValueA GetUserNameA LookupAccountSidA GetTokenInformation OpenProcessToken AdjustTokenPrivileges

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

psapi

GetModuleFileNameExA

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-27_582c65094d3ec6612bf5c26636c04d9b_amadey_elex_graftor_redline-stealer_rhadamanthys_smoke-loader_stop

kernel32

user32

advapi32

version

psapi

generic