2026-08-02_c82f1d58fb1636e78353f0df68e4db33_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-02_c82f1d58fb1636e78353f0df68e4db33_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
Size 14.9MB
Sample260802-mvx83a1dkf
SHA256 d0aac84951824ffec0fd576ca32f15c2afbd0884a1ea8ad4393fa022bfd475c5
MD5 c82f1d58fb1636e78353f0df68e4db33
SHA1 47da3eb6dffaf5f0fd97713e35ae877fb0580ad1
SHA512 42971361860d4536348eed62e627e4503bf80a4d9bc61077abd8fde942c35761a539a0e5dcd13b227388780bf4d85b533c8f8e735dd6e1e6769b46236bb9bb4b
SSDEEP 98304:0szzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzj:
TLSH
T10FF63B5037F35882F7668E7A66369AB4D7FBFC92F821929F13419B5F1870781C602722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-02_c82f1d58fb1636e78353f0df68e4db33_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

File Explorer

2026-08-02_c82f1d58fb1636e78353f0df68e4db33_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

.exe 14.9MB

2026-08-02_c82f1d58fb1636e78353f0df68e4db33_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

IMPHASH b18351593449506f4a27066556c25f68
SHA256 d0aac84951824ffec0fd576ca32f15c2afbd0884a1ea8ad4393fa022bfd475c5
MD5 c82f1d58fb1636e78353f0df68e4db33
SHA1 47da3eb6dffaf5f0fd97713e35ae877fb0580ad1
SHA512 42971361860d4536348eed62e627e4503bf80a4d9bc61077abd8fde942c35761a539a0e5dcd13b227388780bf4d85b533c8f8e735dd6e1e6769b46236bb9bb4b
SSDEEP 98304:0szzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzj:
TLSH
T10FF63B5037F35882F7668E7A66369AB4D7FBFC92F821929F13419B5F1870781C602722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8539

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindResourceA IsBadStringPtrW CommConfigDialogA SetEndOfFile FindResourceW LocalCompact WriteConsoleInputA GetComputerNameW SetProcessPriorityBoost GlobalFindAtomA LoadLibraryW FreeConsole CreateEventA GetModuleFileNameW CreateFileW GetACP ReplaceFileA CreateDirectoryA GetLastError RemoveVectoredExceptionHandler GetProcAddress GlobalFree LocalAlloc EnumResourceTypesW GetModuleHandleA CancelIo GetWindowsDirectoryW OpenFileMappingA SetFileAttributesW HeapReAlloc HeapAlloc HeapSize GetStringTypeW SetLastError GetDateFormatW MultiByteToWideChar LCMapStringW RtlUnwind Sleep HeapFree GetCommandLineA HeapSetInformation GetStartupInfoW IsProcessorFeaturePresent HeapCreate SetUnhandledExceptionFilter GetModuleHandleW ExitProcess DecodePointer WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime UnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess GetCPInfo GetOEMCP IsValidCodePage LeaveCriticalSection EnterCriticalSection RaiseException

user32

GetKeyboardLayoutNameA SetMessageExtraInfo GetCaretPos DdeCmpStringHandles GetClassInfoW InsertMenuItemW CharUpperBuffA

advapi32

GetLengthSid

ole32

CoSuspendClassObjects CoMarshalHresult

winhttp

WinHttpWriteData

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-02_c82f1d58fb1636e78353f0df68e4db33_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

kernel32

user32

advapi32

ole32

winhttp

generic