2026-07-30_53bc7e96cee1787ba3c56508e97869c6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

General

Target
2026-07-30_53bc7e96cee1787ba3c56508e97869c6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
Size 70KB
Sample260730-d17v1sbb48
SHA256 3ef6e3b71fe1a8b7f01d0a63ffad83f927d3dbca059cb8638405f1762dd33b3d
MD5 53bc7e96cee1787ba3c56508e97869c6
SHA1 b7d81d748d7c0db6a5f72dc7e40ff094eb50991d
SHA512 63bae268f1478ed0a7d0e775bd3c87939ab8d381c47a884453cd0614dc56618a27ebe1e0d3d1c1865afb5bd55b00f2ba3134d3e229286167848e11a3a33a7f18
SSDEEP 1536:bm69v5i/XaUK4jYFpe+rlTq1emWkh6k3Owf:bmohcaR4elTq1emd6C
TLSH
T170639F117884C773C41544B1196AC2A14B7FE8126AA9898BFF881FAF9F705D09B3637F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_53bc7e96cee1787ba3c56508e97869c6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

File Explorer

2026-07-30_53bc7e96cee1787ba3c56508e97869c6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

.exe 70KB

2026-07-30_53bc7e96cee1787ba3c56508e97869c6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

IMPHASH 74163037421806f0cf9c27e968112bc2
SHA256 3ef6e3b71fe1a8b7f01d0a63ffad83f927d3dbca059cb8638405f1762dd33b3d
MD5 53bc7e96cee1787ba3c56508e97869c6
SHA1 b7d81d748d7c0db6a5f72dc7e40ff094eb50991d
SHA512 63bae268f1478ed0a7d0e775bd3c87939ab8d381c47a884453cd0614dc56618a27ebe1e0d3d1c1865afb5bd55b00f2ba3134d3e229286167848e11a3a33a7f18
SSDEEP 1536:bm69v5i/XaUK4jYFpe+rlTq1emWkh6k3Owf:bmohcaR4elTq1emd6C
TLSH
T170639F117884C773C41544B1196AC2A14B7FE8126AA9898BFF881FAF9F705D09B3637F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

13051

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentProcess GetVersionExA OpenFile FreeLibrary GetProcAddress LoadLibraryA _lcreat _lclose _lopen GetModuleFileNameA GetModuleHandleA GetCommandLineA SetErrorMode WinExec LCMapStringW LCMapStringA GetStringTypeW MultiByteToWideChar GetStringTypeA GetLocaleInfoA RtlUnwind HeapReAlloc VirtualAlloc HeapAlloc InitializeCriticalSectionAndSpinCount ExitProcess _lwrite GetLastError lstrcatA FormatMessageA LocalFree lstrcpyA GetTempPathA GetWindowsDirectoryA GetTempFileNameA MulDiv lstrlenA _lread _llseek GlobalLock GlobalUnlock GlobalFree GlobalAlloc HeapSize GetStartupInfoA GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent Sleep WriteFile GetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection HeapCreate VirtualFree HeapFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage

user32

wsprintfA ExitWindowsEx CreateWindowExA ShowWindow SetWindowPos UpdateWindow SetTimer LoadIconA LoadCursorA RegisterClassA MessageBoxA DefWindowProcA BeginPaint DrawTextA EndPaint InvalidateRect PostQuitMessage SendMessageA GetDC ReleaseDC GetClientRect

gdi32

GetStockObject CreatePalette SelectPalette RealizePalette GetDeviceCaps CreateFontA StretchDIBits SelectObject SetBkMode SetTextColor TextOutA DeleteObject CreateSolidBrush PatBlt

advapi32

OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_53bc7e96cee1787ba3c56508e97869c6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

kernel32

user32

gdi32

advapi32

generic