2026-07-28_95e35ff8a6847070b93c732d041b5fac_elex_redline-stealer_rhadamanthys_stop

General

Target
2026-07-28_95e35ff8a6847070b93c732d041b5fac_elex_redline-stealer_rhadamanthys_stop
Size 104KB
Sample260728-mstsvsvbqb
SHA256 5f79c70f48dac87217b18a3c52ce0f5d115ef4d2b7eda245d493061e4e4363f4
MD5 95e35ff8a6847070b93c732d041b5fac
SHA1 4a9553bc11a02fbe9bc84e6e351c931e066ce25a
SHA512 df06906474585b01a9ff571bebe9b9b14d9937778b3932a4e8566c1ef289f0b3e0752a978c94e82acf017e5061cc8ac7bdf4a3720149f51d59c21135b7a238b5
SSDEEP 1536:JZu8+1+1jYPyrz2mCJq63Lrt6pDhQ64bCwYeEODRqUUA5i:JM8g+AyWznQpDhQ6OCwYeEOcUUgi
TLSH
T1ADA3492C79618C73C44543734A36D5691A2E7C232F64888BF79C3B5A7E33AFD563A206
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-28_95e35ff8a6847070b93c732d041b5fac_elex_redline-stealer_rhadamanthys_stop

File Explorer

2026-07-28_95e35ff8a6847070b93c732d041b5fac_elex_redline-stealer_rhadamanthys_stop

.exe 104KB

2026-07-28_95e35ff8a6847070b93c732d041b5fac_elex_redline-stealer_rhadamanthys_stop

IMPHASH a8a983d90cccb49be98c2c05febd4492
SHA256 5f79c70f48dac87217b18a3c52ce0f5d115ef4d2b7eda245d493061e4e4363f4
MD5 95e35ff8a6847070b93c732d041b5fac
SHA1 4a9553bc11a02fbe9bc84e6e351c931e066ce25a
SHA512 df06906474585b01a9ff571bebe9b9b14d9937778b3932a4e8566c1ef289f0b3e0752a978c94e82acf017e5061cc8ac7bdf4a3720149f51d59c21135b7a238b5
SSDEEP 1536:JZu8+1+1jYPyrz2mCJq63Lrt6pDhQ64bCwYeEODRqUUA5i:JM8g+AyWznQpDhQ6OCwYeEOcUUgi
TLSH
T1ADA3492C79618C73C44543734A36D5691A2E7C232F64888BF79C3B5A7E33AFD563A206
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

16058

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

s:\SonTC\Live Update\bLiveUpdate\Release\BLuPro.pdb

kernel32

DuplicateHandle GetCurrentThread DisconnectNamedPipe FlushFileBuffers GetExitCodeThread TlsAlloc CreateEventA SetEvent TlsSetValue TlsGetValue SetNamedPipeHandleState WaitNamedPipeA CreateFileA GetCurrentProcessId TlsFree ReadFile WriteFile CopyFileA GetFileAttributesA SetFileAttributesA CreateDirectoryA GetCurrentThreadId SetFilePointer WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle InitializeCriticalSectionAndSpinCount VirtualAlloc HeapReAlloc GetLocaleInfoA WaitForSingleObject CloseHandle GetCurrentProcess WideCharToMultiByte OutputDebugStringA CreateMutexA GetLastError lstrlenA Sleep ExpandEnvironmentStringsA GetSystemDirectoryA CreateThread GetCommandLineA ExitProcess LoadLibraryA LoadLibraryExA GetProcAddress GetModuleHandleA FreeLibrary GetStartupInfoA GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetModuleHandleW SetLastError TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind HeapSize HeapAlloc RaiseException HeapFree EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle GetFileType DeleteCriticalSection GetConsoleCP GetConsoleMode MultiByteToWideChar GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

user32

FindWindowA LoadImageA LoadCursorA RegisterClassExA CreateWindowExA ShowWindow UpdateWindow GetMessageA TranslateMessage DispatchMessageA BeginPaint EndPaint PostQuitMessage DestroyWindow DefWindowProcA MessageBoxA SendMessageA

gdi32

TextOutA

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey RegSetValueExA

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-28_95e35ff8a6847070b93c732d041b5fac_elex_redline-stealer_rhadamanthys_stop

kernel32

user32

gdi32

advapi32

generic