General
- Target 2026-08-06_b38cc09f5dfaf6939602d2b9de295806_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_swisyn
- Size 7.0MB
- Sample260806-2m13bavxas
- SHA256 b1cfe8ccaa72587ecd9dfa52c499ca4e7d6cd0eec98c030e8e29351593a71ac9
- MD5 b38cc09f5dfaf6939602d2b9de295806
- SHA1 a99df45ecced89ee526db774df35979d23bc6797
- SHA512 8e10c3b471e008564765663ca576544882528771c8e8f7c4a191237ac2cce5716478a698341a388eb001fb56a4cd5a67c208114cb3b79fa49959d6cd7078cb28
- SSDEEP 98304:cRWKtOl5CCGomEBkHUBmExJrIUg32t9RRyvo7VnOcyP24Vc35re94tb0eYbY1poi:c3tO3CCT/hBxtVtyUVnmSprzVIY7QKAu
- TLSH T1E77633329A54902BD16300B3F518D621BE7DB92C1F105C6BA354AB193A786C7BEF734B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-06_b38cc09f5dfaf6939602d2b9de295806_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_swisyn.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-06_b38cc09f5dfaf6939602d2b9de295806_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_swisyn.exe
Resource
win11ltsc2024-20260710-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-06_b38cc09f5dfaf6939602d2b9de295806_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_swisyn
- Size 7.0MB
- SHA256 b1cfe8ccaa72587ecd9dfa52c499ca4e7d6cd0eec98c030e8e29351593a71ac9
- MD5 b38cc09f5dfaf6939602d2b9de295806
- SHA1 a99df45ecced89ee526db774df35979d23bc6797
- SHA512 8e10c3b471e008564765663ca576544882528771c8e8f7c4a191237ac2cce5716478a698341a388eb001fb56a4cd5a67c208114cb3b79fa49959d6cd7078cb28
- SSDEEP 98304:cRWKtOl5CCGomEBkHUBmExJrIUg32t9RRyvo7VnOcyP24Vc35re94tb0eYbY1poi:c3tO3CCT/hBxtVtyUVnmSprzVIY7QKAu
- TLSH T1E77633329A54902BD16300B3F518D621BE7DB92C1F105C6BA354AB193A786C7BEF734B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies visibility of hidden/system files in Explorer
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2