2026-07-30_1cd157b928d88c950fe02e266fb2e691_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

General

Target
2026-07-30_1cd157b928d88c950fe02e266fb2e691_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
Size 123KB
Sample260730-wp9vcathrg
SHA256 5eeebd4ccbe94df25964341a329caf19b04343b8b53939f4749d3e285af8b359
MD5 1cd157b928d88c950fe02e266fb2e691
SHA1 b0719906190e7dfb706cb70d75bf15a58219b99c
SHA512 4e20e25f5645f067f0051aa6cbeb4c60a56c043e8f864a71b867efc1aabc3b2dc11b2a5b2cbf92396a840c784fbba423cef954032996b979da6661ced1501dae
SSDEEP 1536:Hfqq8/DMFv8I8ReUWflaCoa7CYsIRJF6Sdgjnv56PZVivVTxS8lQ9IIkoSWtq3ng:/cDSbca7C7IRJRgoPxRGHlAlSsAM
TLSH
T187C3D0527610C037C41260755869C2E24A3EBD311AF9C84B7FE91BBB5F632EA663D34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_1cd157b928d88c950fe02e266fb2e691_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

File Explorer

2026-07-30_1cd157b928d88c950fe02e266fb2e691_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

.exe 123KB

2026-07-30_1cd157b928d88c950fe02e266fb2e691_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

IMPHASH 4749670ac3d28d6761142b0dcb4f5076
SHA256 5eeebd4ccbe94df25964341a329caf19b04343b8b53939f4749d3e285af8b359
MD5 1cd157b928d88c950fe02e266fb2e691
SHA1 b0719906190e7dfb706cb70d75bf15a58219b99c
SHA512 4e20e25f5645f067f0051aa6cbeb4c60a56c043e8f864a71b867efc1aabc3b2dc11b2a5b2cbf92396a840c784fbba423cef954032996b979da6661ced1501dae
SSDEEP 1536:Hfqq8/DMFv8I8ReUWflaCoa7CYsIRJF6Sdgjnv56PZVivVTxS8lQ9IIkoSWtq3ng:/cDSbca7C7IRJRgoPxRGHlAlSsAM
TLSH
T187C3D0527610C037C41260755869C2E24A3EBD311AF9C84B7FE91BBB5F632EA663D34B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

7590

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WriteFile DisconnectNamedPipe InterlockedIncrement InterlockedDecrement CreateProcessA WaitForSingleObject GetExitCodeProcess CreateNamedPipeA ConnectNamedPipe CreateEventA GetCurrentProcessId OpenProcess LocalAlloc LocalFree CloseHandle SetEvent ReadFile GetLastError ExitThread ResumeThread CreateThread GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId Sleep ExitProcess HeapFree EnterCriticalSection LeaveCriticalSection GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage LoadLibraryA InitializeCriticalSectionAndSpinCount RtlUnwind HeapAlloc VirtualAlloc HeapReAlloc SetFilePointer GetConsoleCP GetConsoleMode GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW LCMapStringA LCMapStringW HeapSize FlushFileBuffers SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA

advapi32

SetSecurityDescriptorDacl StartServiceCtrlDispatcherA RegisterServiceCtrlHandlerA OpenProcessToken GetTokenInformation AllocateAndInitializeSid EqualSid FreeSid OpenSCManagerA OpenServiceA CloseServiceHandle DeleteService SetServiceStatus InitializeSecurityDescriptor

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_1cd157b928d88c950fe02e266fb2e691_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

kernel32

advapi32

generic