2026-08-04_206e2b42c34700c0cbc55ee296c3f225_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_206e2b42c34700c0cbc55ee296c3f225_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
Size 11.1MB
Sample260804-tz4d7svdlc
SHA256 5544c41365338a7ea444f841706d45802cfbc7c4372b2ebdabbad411bebfd26e
MD5 206e2b42c34700c0cbc55ee296c3f225
SHA1 5667c2aa83c6d1ca54bb1637555cda12f30163d9
SHA512 f27b1d9010316e7cc5895601e7abc9c95401bbce10bff538a5ae0e3c9e3779d8a85dfdbfc88b6f2847d1339c983754f178c3fdb0acaa1deca902858d6fae7f66
SSDEEP 98304:sszzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzX:
TLSH
T1B2C63B5037F35882F7668E7A66369AB4D7FBFC92F821929F13419B5F1870781C602722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_206e2b42c34700c0cbc55ee296c3f225_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

File Explorer

2026-08-04_206e2b42c34700c0cbc55ee296c3f225_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

.exe 11.1MB

2026-08-04_206e2b42c34700c0cbc55ee296c3f225_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

IMPHASH b18351593449506f4a27066556c25f68
SHA256 5544c41365338a7ea444f841706d45802cfbc7c4372b2ebdabbad411bebfd26e
MD5 206e2b42c34700c0cbc55ee296c3f225
SHA1 5667c2aa83c6d1ca54bb1637555cda12f30163d9
SHA512 f27b1d9010316e7cc5895601e7abc9c95401bbce10bff538a5ae0e3c9e3779d8a85dfdbfc88b6f2847d1339c983754f178c3fdb0acaa1deca902858d6fae7f66
SSDEEP 98304:sszzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzX:
TLSH
T1B2C63B5037F35882F7668E7A66369AB4D7FBFC92F821929F13419B5F1870781C602722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8539

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindResourceA IsBadStringPtrW CommConfigDialogA SetEndOfFile FindResourceW LocalCompact WriteConsoleInputA GetComputerNameW SetProcessPriorityBoost GlobalFindAtomA LoadLibraryW FreeConsole CreateEventA GetModuleFileNameW CreateFileW GetACP ReplaceFileA CreateDirectoryA GetLastError RemoveVectoredExceptionHandler GetProcAddress GlobalFree LocalAlloc EnumResourceTypesW GetModuleHandleA CancelIo GetWindowsDirectoryW OpenFileMappingA SetFileAttributesW HeapReAlloc HeapAlloc HeapSize GetStringTypeW SetLastError GetDateFormatW MultiByteToWideChar LCMapStringW RtlUnwind Sleep HeapFree GetCommandLineA HeapSetInformation GetStartupInfoW IsProcessorFeaturePresent HeapCreate SetUnhandledExceptionFilter GetModuleHandleW ExitProcess DecodePointer WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime UnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess GetCPInfo GetOEMCP IsValidCodePage LeaveCriticalSection EnterCriticalSection RaiseException

user32

GetKeyboardLayoutNameA SetMessageExtraInfo GetCaretPos DdeCmpStringHandles GetClassInfoW InsertMenuItemW CharUpperBuffA

advapi32

GetLengthSid

ole32

CoSuspendClassObjects CoMarshalHresult

winhttp

WinHttpWriteData

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_206e2b42c34700c0cbc55ee296c3f225_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

kernel32

user32

advapi32

ole32

winhttp

generic