2026-07-28_93a751b57a4f142e49c9bb10df00dd64_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

General

Target
2026-07-28_93a751b57a4f142e49c9bb10df00dd64_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
Size 218KB
Sample260728-e9ca5sbj3z
SHA256 ce7b050a45d9a524919e8b15212e28b62540d2c6c3f2183060b3eac0f9d7b4dc
MD5 93a751b57a4f142e49c9bb10df00dd64
SHA1 56ef5e14923486c8e9dd7c8622135c74717f0164
SHA512 8437832bd665c4474acdcc71133f5d3b282e282ff69b4c30f3c972d79f935246100146c723bceaae161a4e3e1b8a898aaabbfa5d3fe9f49f26c369a3ea71cd83
SSDEEP 3072:Dr5sLn+meUaQ/xrHS9sf2QQRsEP7w0SJVvbktO07:W3lbSQQR0JV8
TLSH
T1AF247D05F702CC33C4C104BC6161D7B26A3E6A336BAF90A7FBD90A5A7B702E19635756
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-28_93a751b57a4f142e49c9bb10df00dd64_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

File Explorer

2026-07-28_93a751b57a4f142e49c9bb10df00dd64_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

.exe 218KB

2026-07-28_93a751b57a4f142e49c9bb10df00dd64_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

IMPHASH 6b23540ad293d5de6344f8d7ab294d27
SHA256 ce7b050a45d9a524919e8b15212e28b62540d2c6c3f2183060b3eac0f9d7b4dc
MD5 93a751b57a4f142e49c9bb10df00dd64
SHA1 56ef5e14923486c8e9dd7c8622135c74717f0164
SHA512 8437832bd665c4474acdcc71133f5d3b282e282ff69b4c30f3c972d79f935246100146c723bceaae161a4e3e1b8a898aaabbfa5d3fe9f49f26c369a3ea71cd83
SSDEEP 3072:Dr5sLn+meUaQ/xrHS9sf2QQRsEP7w0SJVvbktO07:W3lbSQQR0JV8
TLSH
T1AF247D05F702CC33C4C104BC6161D7B26A3E6A336BAF90A7FBD90A5A7B702E19635756
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7951

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

f:\workspace\depot_erbium\current\enmm\release_unicode\ENMM.pdb

mpr

WNetOpenEnumW WNetAddConnection2W WNetCloseEnum WNetEnumResourceW

kernel32

SetHandleCount FlushFileBuffers CloseHandle CreateFileA LocalFree FindFirstFileW FindClose GetCommandLineW GetDriveTypeW GetProcAddress GetModuleHandleA GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap GetStartupInfoA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetLastError GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW GetFileType DeleteCriticalSection HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer GetConsoleCP GetConsoleMode EnterCriticalSection LeaveCriticalSection Sleep MultiByteToWideChar VirtualAlloc HeapReAlloc RaiseException LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA LoadLibraryA InitializeCriticalSection RtlUnwind SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW HeapSize

shell32

CommandLineToArgvW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-28_93a751b57a4f142e49c9bb10df00dd64_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

mpr

kernel32

shell32

generic