2026-07-31_c3912de9d6535e9842f4c71af08aa122_amadey_elex_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-31_c3912de9d6535e9842f4c71af08aa122_amadey_elex_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 12.0MB
Sample260731-vbprkswfqe
SHA256 b20089618962b714d49fe2f8822850451cee4c4fb1c5d02c391ef1d5bfa99a8b
MD5 c3912de9d6535e9842f4c71af08aa122
SHA1 0ed04877d8ba03b9075c8038f025eca5cf908d73
SHA512 2da9dba368f3ac7890e1cea538ba03c62093c3d7f95c0a87e605681748052df9efcfde4b26477b11ecb3ec43aa57c5740d2f81779fc6ba095e496c72acdcf7ed
SSDEEP 49152:pGEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE0:p
TLSH
T1B5C6016176FE9119F3F79E346AB667981A7BBDA3783481BD0110230A5D32EC18D91F23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-31_c3912de9d6535e9842f4c71af08aa122_amadey_elex_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-07-31_c3912de9d6535e9842f4c71af08aa122_amadey_elex_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 12.0MB

2026-07-31_c3912de9d6535e9842f4c71af08aa122_amadey_elex_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH e381a5a93083caf35e69fd7d319ba0c4
SHA256 b20089618962b714d49fe2f8822850451cee4c4fb1c5d02c391ef1d5bfa99a8b
MD5 c3912de9d6535e9842f4c71af08aa122
SHA1 0ed04877d8ba03b9075c8038f025eca5cf908d73
SHA512 2da9dba368f3ac7890e1cea538ba03c62093c3d7f95c0a87e605681748052df9efcfde4b26477b11ecb3ec43aa57c5740d2f81779fc6ba095e496c72acdcf7ed
SSDEEP 49152:pGEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE0:p
TLSH
T1B5C6016176FE9119F3F79E346AB667981A7BBDA3783481BD0110230A5D32EC18D91F23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7857

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetNumaProcessorNode DebugActiveProcessStop GetConsoleAliasExesLengthA SetUnhandledExceptionFilter InterlockedIncrement WaitForSingleObject SetComputerNameW ConnectNamedPipe GetModuleHandleW GetTickCount LoadLibraryW GetLocaleInfoW GetFileAttributesA HeapCreate lstrcpynW FindNextVolumeMountPointW SetConsoleTitleA GetConsoleOutputCP GetLastError TryEnterCriticalSection GetThreadLocale GetProcAddress HeapSize GetAtomNameA CreateHardLinkW FindAtomA GlobalFindAtomW SetSystemTime GetModuleFileNameA SetConsoleTitleW HeapSetInformation GetCurrentDirectoryA SetCalendarInfoA FindAtomW CloseHandle GetLongPathNameW CreateFileA CreateFileW ReadFile FlushFileBuffers HeapReAlloc HeapAlloc GetCommandLineA GetStartupInfoW RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent DecodePointer EncodePointer HeapFree IsProcessorFeaturePresent ExitProcess WriteFile GetStdHandle GetModuleFileNameW EnterCriticalSection LeaveCriticalSection FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage Sleep RtlUnwind MultiByteToWideChar SetStdHandle WriteConsoleW LCMapStringW GetStringTypeW

user32

CopyRect GetMonitorInfoW LoadIconW

advapi32

RegCreateKeyW

ole32

CoTaskMemFree

winhttp

WinHttpOpen

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-31_c3912de9d6535e9842f4c71af08aa122_amadey_elex_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee

kernel32

user32

advapi32

ole32

winhttp

generic