General
- Target 2026-08-03_9dc3dd6714967f1a7b046216b9f3879e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
- Size 766KB
- Sample260804-ml1b3axhkb
- SHA256 141596fc80998c333bdb35c121bb18c2ae3e4fd1b656dcbc429378e92428d918
- MD5 9dc3dd6714967f1a7b046216b9f3879e
- SHA1 1ebb8f544eff49e333317c2ee776a93f90123246
- SHA512 04369ac2c580305e7eb52b535926904c292ce4348eff34d66ed5b4acc2bbf7792d367456af334d7ce69dd5f961620fba4d17ca4694f94958b1d6a8666e92f73a
- SSDEEP 12288:Htg6vsYavZzdvSRA4Txv9IE8Imbg2x6B6qTJCIQ2MgRx22c068Da7dZfFj2Dyvb:Hu6rUZ1SRRT7IELKg2x6YAc7g3xg8CRm
- TLSH T157F4127172C0C476E627097289A9CF704EBA7C7A29B0440F3BE878391E763E1525D79E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_9dc3dd6714967f1a7b046216b9f3879e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_9dc3dd6714967f1a7b046216b9f3879e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
16 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-03_9dc3dd6714967f1a7b046216b9f3879e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
- Size 766KB
- SHA256 141596fc80998c333bdb35c121bb18c2ae3e4fd1b656dcbc429378e92428d918
- MD5 9dc3dd6714967f1a7b046216b9f3879e
- SHA1 1ebb8f544eff49e333317c2ee776a93f90123246
- SHA512 04369ac2c580305e7eb52b535926904c292ce4348eff34d66ed5b4acc2bbf7792d367456af334d7ce69dd5f961620fba4d17ca4694f94958b1d6a8666e92f73a
- SSDEEP 12288:Htg6vsYavZzdvSRA4Txv9IE8Imbg2x6B6qTJCIQ2MgRx22c068Da7dZfFj2Dyvb:Hu6rUZ1SRRT7IELKg2x6YAc7g3xg8CRm
- TLSH T157F4127172C0C476E627097289A9CF704EBA7C7A29B0440F3BE878391E763E1525D79E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1