2026-08-08_21973fd8fb5e02c7ba008cc3b7e04ed9_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

General

Target
2026-08-08_21973fd8fb5e02c7ba008cc3b7e04ed9_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 15.0MB
Sample260808-ejj83abf43
SHA256 49329286310ccf27c2cf5e45109daa2b59181cf88e87f95bd038482e48db1c5c
MD5 21973fd8fb5e02c7ba008cc3b7e04ed9
SHA1 358544d7cdb3f0f4de00247618a002b8c24d6ab6
SHA512 0306a932bc9f04ed9d7ecb77bd5de320d180887c0c314823e4d834c694c6c62cd06df79d129d9a0b21e6366c0afb0dff309e43d93b61571e46afb5730f89e195
SSDEEP 3072:LsXLLViObJLO9Dpqs4XzM9lOp7LCHI3lwQ4fVUxfhuC9+QoZ5G2F5QoQb:MLLViWJLO1zczM9lOpSHILcV8N9+Ay
TLSH
T10AF629388A608555C03ED6BE320CBB4186BEEE81E384997A26074DD4DB235F54DDDF2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_21973fd8fb5e02c7ba008cc3b7e04ed9_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-08-08_21973fd8fb5e02c7ba008cc3b7e04ed9_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 15.0MB

2026-08-08_21973fd8fb5e02c7ba008cc3b7e04ed9_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH 250c7ffe1eac5d973afc59a6282d7a03
SHA256 49329286310ccf27c2cf5e45109daa2b59181cf88e87f95bd038482e48db1c5c
MD5 21973fd8fb5e02c7ba008cc3b7e04ed9
SHA1 358544d7cdb3f0f4de00247618a002b8c24d6ab6
SHA512 0306a932bc9f04ed9d7ecb77bd5de320d180887c0c314823e4d834c694c6c62cd06df79d129d9a0b21e6366c0afb0dff309e43d93b61571e46afb5730f89e195
SSDEEP 3072:LsXLLViObJLO9Dpqs4XzM9lOp7LCHI3lwQ4fVUxfhuC9+QoZ5G2F5QoQb:MLLViWJLO1zczM9lOpSHILcV8N9+Ay
TLSH
T10AF629388A608555C03ED6BE320CBB4186BEEE81E384997A26074DD4DB235F54DDDF2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

34735

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\joninexu wixatun.pdb

kernel32

FindFirstFileW PeekNamedPipe SetComputerNameExA AllocConsole GetConsoleAliasExesLengthA BuildCommDCBAndTimeoutsA DeleteVolumeMountPointA SetConsoleTextAttribute GetCommState GetSystemWindowsDirectoryW CreateDirectoryW FreeEnvironmentStringsA GetTickCount ReadDirectoryChangesW GetConsoleAliasesA WideCharToMultiByte LoadLibraryW IsProcessorFeaturePresent GetConsoleAliasW GetVolumePathNameA InterlockedExchange FillConsoleOutputCharacterW GetLastError InterlockedFlushSList SetLastError BackupRead SetPriorityClass VirtualAlloc PeekConsoleInputW CreateNamedPipeA RemoveDirectoryA EnumSystemCodePagesW OpenWaitableTimerA LocalAlloc GetNumberFormatW FoldStringW DebugSetProcessKillOnExit GetModuleHandleA UpdateResourceW FatalExit FreeEnvironmentStringsW VirtualProtect ReadConsoleInputW GetWindowsDirectoryW GlobalAddAtomW AddConsoleAliasA SetFileAttributesW LocalFileTimeToFileTime WriteConsoleW GetConsoleOutputCP FindResourceA CreateFileA GetProcAddress WriteConsoleA CloseHandle HeapFree GetModuleHandleW Sleep ExitProcess GetStartupInfoW RaiseException RtlUnwind GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc HeapSize MultiByteToWideChar ReadFile SetHandleCount GetStdHandle GetFileType GetStartupInfoA SetFilePointer WriteFile GetModuleFileNameA LoadLibraryA InitializeCriticalSectionAndSpinCount GetModuleFileNameW GetEnvironmentStringsW GetCommandLineW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers

user32

LoadMenuW CharToOemBuffW ChangeDisplaySettingsA

gdi32

GetCharWidthA GetCharABCWidthsFloatA GetBoundsRect

ole32

StringFromCLSID

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_21973fd8fb5e02c7ba008cc3b7e04ed9_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

kernel32

user32

gdi32

ole32

generic