2026-08-02_4577971b2375eaf36d0b4176e2289433_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

General

Target
2026-08-02_4577971b2375eaf36d0b4176e2289433_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
Size 1.3MB
Sample260802-drrsfacd92
SHA256 1af155f09968fc85733adafd69fa5d2ebdff3e7e6de6963034d29514cb7f2fc5
MD5 4577971b2375eaf36d0b4176e2289433
SHA1 03c5469248b506e0412d3cb3d2b523f1412979a1
SHA512 fb936fced4a9a0a4ad036f9eb10e62ae0b2b35a73ac4e8b88c0cc5171b170cb2278adb95cef2d7c90318846983acad3a41b3a2cf8ad3886f4b5a016a5d3e746e
SSDEEP 12288:La9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:LadnQ/tbw/2Mkjy6Fr7g0o4
TLSH
T1EA5523767901F477E81611B50852C2A25B3F8CB16BB4D7C77B88172E9B393D01E6B386
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-02_4577971b2375eaf36d0b4176e2289433_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

File Explorer

2026-08-02_4577971b2375eaf36d0b4176e2289433_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

.exe 1.3MB

2026-08-02_4577971b2375eaf36d0b4176e2289433_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

IMPHASH 4c5f51b90a834834cf0a68ebdf3c7b63
SHA256 1af155f09968fc85733adafd69fa5d2ebdff3e7e6de6963034d29514cb7f2fc5
MD5 4577971b2375eaf36d0b4176e2289433
SHA1 03c5469248b506e0412d3cb3d2b523f1412979a1
SHA512 fb936fced4a9a0a4ad036f9eb10e62ae0b2b35a73ac4e8b88c0cc5171b170cb2278adb95cef2d7c90318846983acad3a41b3a2cf8ad3886f4b5a016a5d3e746e
SSDEEP 12288:La9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:LadnQ/tbw/2Mkjy6Fr7g0o4
TLSH
T1EA5523767901F477E81611B50852C2A25B3F8CB16BB4D7C77B88172E9B393D01E6B386
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

19812

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ntdll

RtlUnwind

kernel32

HeapFree GetModuleHandleW Sleep GetProcAddress ExitProcess GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualFree VirtualAlloc HeapCreate GetStdHandle GetModuleFileNameA GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId HeapReAlloc LoadLibraryA InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetConsoleCP GetConsoleMode LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW HeapAlloc WaitForMultipleObjects CreateEventA CreateMailslotA LocalAlloc SetEvent GetSystemWindowsDirectoryA GetWindowsDirectoryA CreateFileA CloseHandle GetFileSize SetFilePointer WriteFile FlushFileBuffers ReadFile GetLastError DeviceIoControl

advapi32

StartServiceCtrlDispatcherA RegisterEventSourceA AllocateAndInitializeSid SetEntriesInAclA InitializeSecurityDescriptor SetSecurityDescriptorDacl SetServiceStatus ReportEventA RegDeleteValueA RegCreateKeyExA RegEnumValueA RegCreateKeyA RegSetValueExA RegOpenKeyExA RegQueryValueExA RegCloseKey RegOpenKeyA RegDeleteKeyA RegisterServiceCtrlHandlerA

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-02_4577971b2375eaf36d0b4176e2289433_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

ntdll

kernel32

advapi32

generic