2026-07-29_84bca9f053669b9e1a08e1692a19d133_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

General

Target
2026-07-29_84bca9f053669b9e1a08e1692a19d133_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 229KB
Sample260729-pgbh9atelc
SHA256 e7fd22ff8a38121ea32c5532629ddd3cddd33896a455de33496e8392ccc88f8f
MD5 84bca9f053669b9e1a08e1692a19d133
SHA1 1ae22d48b3a1e6ff6d8f121c3a0a25bb8252e2d5
SHA512 1c6c8bb83378ff9cf03a796ea57978f43ba5834092688ce564fa60ed4f4f814c7d02d221158477adb9b62988f9f44792a5b6e4df6a39e50781037108a72921be
SSDEEP 3072:eDMHYLqdYnw0G/tqGAkqArDBbnllTmuRtcP3gMNOoKWvFu6zzh:V4Lq8rswW9bB/cP3dIoKW86h
TLSH
T1E7349E1371F0FCE4D42646718E2EC6E8766EB5A1CF486767329A6B2F19701B2E273311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-29_84bca9f053669b9e1a08e1692a19d133_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-07-29_84bca9f053669b9e1a08e1692a19d133_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 229KB

2026-07-29_84bca9f053669b9e1a08e1692a19d133_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH 4c85c3475b5560fd3062bdac62df5127
SHA256 e7fd22ff8a38121ea32c5532629ddd3cddd33896a455de33496e8392ccc88f8f
MD5 84bca9f053669b9e1a08e1692a19d133
SHA1 1ae22d48b3a1e6ff6d8f121c3a0a25bb8252e2d5
SHA512 1c6c8bb83378ff9cf03a796ea57978f43ba5834092688ce564fa60ed4f4f814c7d02d221158477adb9b62988f9f44792a5b6e4df6a39e50781037108a72921be
SSDEEP 3072:eDMHYLqdYnw0G/tqGAkqArDBbnllTmuRtcP3gMNOoKWvFu6zzh:V4Lq8rswW9bB/cP3dIoKW86h
TLSH
T1E7349E1371F0FCE4D42646718E2EC6E8766EB5A1CF486767329A6B2F19701B2E273311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

17568

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\jovedudegayeyo\cikuxufuleduk31\vizojate\todileja\hevi\xigak.pdb

kernel32

CreateMutexW EnumDateFormatsExW GetStringTypeA GetProfileIntW FindResourceExW FindResourceW EnumCalendarInfoW GetComputerNameW UnlockFile GetTickCount GetConsoleAliasesA GetWindowsDirectoryA ClearCommBreak CancelDeviceWakeupRequest GetDateFormatA GlobalAlloc GetSystemWindowsDirectoryA FindNextVolumeW Beep GetVolumePathNameA SetCurrentDirectoryA GetDateFormatW GetLongPathNameW SetLastError lstrcmpiA GetProcAddress BeginUpdateResourceW HeapUnlock CopyFileA EnumSystemCodePagesW LoadLibraryA OpenMutexA GetProcessWorkingSetSize GetModuleHandleA SetLocaleInfoW VirtualProtect ReadConsoleInputW CreateFileA CloseHandle WriteConsoleW GetConsoleOutputCP FindFirstFileA InterlockedIncrement InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection MultiByteToWideChar GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter GetLastError HeapFree RtlUnwind RaiseException HeapAlloc SetHandleCount GetStdHandle GetFileType GetStartupInfoA TerminateProcess GetCurrentProcess IsDebuggerPresent GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId HeapSize ExitProcess GetCPInfo GetACP GetOEMCP IsValidCodePage WriteFile GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime VirtualAlloc HeapReAlloc GetLocaleInfoA GetStringTypeW SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount LCMapStringA LCMapStringW FlushFileBuffers SetStdHandle WriteConsoleA

user32

GetMenuBarInfo DdeQueryStringW LoadMenuW CharToOemBuffW GetClipboardOwner CharUpperBuffW

gdi32

GetCharABCWidthsI

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-29_84bca9f053669b9e1a08e1692a19d133_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

kernel32

user32

gdi32

generic