2026-07-31_1fc79c4d24e671248740cdf9cbb21b68_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-31_1fc79c4d24e671248740cdf9cbb21b68_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
Size 13.9MB
Sample260731-xp3ayafc28
SHA256 0100d8bf48c2a841273b810f2e016f31575e12fad08a9e6b6ac76b964415f182
MD5 1fc79c4d24e671248740cdf9cbb21b68
SHA1 c9edfa1c9edcc5417078566a96e8f5974951f4a1
SHA512 5faad4891910206c33ff466f1e6006448633c7760d830489893055aa012083185678cb655f2b818fec2dbe9169cdd952ad2bf2f88536309703475ab671f2aa8e
SSDEEP 98304:zszzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz3:
TLSH
T142E63B5037F35882F7668E7A66369AB4D7FBFC92F821929F13419B5F1870781C602722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-31_1fc79c4d24e671248740cdf9cbb21b68_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

File Explorer

2026-07-31_1fc79c4d24e671248740cdf9cbb21b68_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

.exe 13.9MB

2026-07-31_1fc79c4d24e671248740cdf9cbb21b68_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

IMPHASH b18351593449506f4a27066556c25f68
SHA256 0100d8bf48c2a841273b810f2e016f31575e12fad08a9e6b6ac76b964415f182
MD5 1fc79c4d24e671248740cdf9cbb21b68
SHA1 c9edfa1c9edcc5417078566a96e8f5974951f4a1
SHA512 5faad4891910206c33ff466f1e6006448633c7760d830489893055aa012083185678cb655f2b818fec2dbe9169cdd952ad2bf2f88536309703475ab671f2aa8e
SSDEEP 98304:zszzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz3:
TLSH
T142E63B5037F35882F7668E7A66369AB4D7FBFC92F821929F13419B5F1870781C602722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8539

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindResourceA IsBadStringPtrW CommConfigDialogA SetEndOfFile FindResourceW LocalCompact WriteConsoleInputA GetComputerNameW SetProcessPriorityBoost GlobalFindAtomA LoadLibraryW FreeConsole CreateEventA GetModuleFileNameW CreateFileW GetACP ReplaceFileA CreateDirectoryA GetLastError RemoveVectoredExceptionHandler GetProcAddress GlobalFree LocalAlloc EnumResourceTypesW GetModuleHandleA CancelIo GetWindowsDirectoryW OpenFileMappingA SetFileAttributesW HeapReAlloc HeapAlloc HeapSize GetStringTypeW SetLastError GetDateFormatW MultiByteToWideChar LCMapStringW RtlUnwind Sleep HeapFree GetCommandLineA HeapSetInformation GetStartupInfoW IsProcessorFeaturePresent HeapCreate SetUnhandledExceptionFilter GetModuleHandleW ExitProcess DecodePointer WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime UnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess GetCPInfo GetOEMCP IsValidCodePage LeaveCriticalSection EnterCriticalSection RaiseException

user32

GetKeyboardLayoutNameA SetMessageExtraInfo GetCaretPos DdeCmpStringHandles GetClassInfoW InsertMenuItemW CharUpperBuffA

advapi32

GetLengthSid

ole32

CoSuspendClassObjects CoMarshalHresult

winhttp

WinHttpWriteData

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-31_1fc79c4d24e671248740cdf9cbb21b68_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

kernel32

user32

advapi32

ole32

winhttp

generic