2026-08-09_b745a1107bc39177e90fcb4d561aabc4_amadey_elex_redline-stealer_smoke-loader

General

Target
2026-08-09_b745a1107bc39177e90fcb4d561aabc4_amadey_elex_redline-stealer_smoke-loader
Size 52KB
Sample260809-2al3maem7v
SHA256 99b67de0dc801d342c8a7be3d1f9bef4e0de3b95c808b413ad2c5eea41c6eb96
MD5 b745a1107bc39177e90fcb4d561aabc4
SHA1 4f7c36b17f6850d927c868f9ab202c6b0f4aa07d
SHA512 10293aa7e3f4fa37227e16ff23858667d99f6141ea232bca3ad10105adff754d947be0dd894ea23cc596794ada00ab3a56ef7f7c50a1a9fc2845eb9c6b3fd819
SSDEEP 768:JpUGawYXYqLkcrdHEYWhZYBS8yi+WyWd+Q6XvVMPkmXEDsAntRiU/Yuh7:J8XYqAodaZYjUWd4XNMPmtR7
TLSH
T1BE334C1636E1C031F0A21F344876D3624B3E7C226B75C58B77A812AD5FB17C09E6A7B6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_b745a1107bc39177e90fcb4d561aabc4_amadey_elex_redline-stealer_smoke-loader

File Explorer

2026-08-09_b745a1107bc39177e90fcb4d561aabc4_amadey_elex_redline-stealer_smoke-loader

.exe 52KB

2026-08-09_b745a1107bc39177e90fcb4d561aabc4_amadey_elex_redline-stealer_smoke-loader

IMPHASH 7f2ede8df5644d843a7a8734782685cf
SHA256 99b67de0dc801d342c8a7be3d1f9bef4e0de3b95c808b413ad2c5eea41c6eb96
MD5 b745a1107bc39177e90fcb4d561aabc4
SHA1 4f7c36b17f6850d927c868f9ab202c6b0f4aa07d
SHA512 10293aa7e3f4fa37227e16ff23858667d99f6141ea232bca3ad10105adff754d947be0dd894ea23cc596794ada00ab3a56ef7f7c50a1a9fc2845eb9c6b3fd819
SSDEEP 768:JpUGawYXYqLkcrdHEYWhZYBS8yi+WyWd+Q6XvVMPkmXEDsAntRiU/Yuh7:J8XYqAodaZYjUWd4XNMPmtR7
TLSH
T1BE334C1636E1C031F0A21F344876D3624B3E7C226B75C58B77A812AD5FB17C09E6A7B6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

6922

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Mhz\Documents\Visual Studio 2010\Projects\adsmon2\Release\adsmon2.pdb

kernel32

GetTickCount GetPrivateProfileStringW OpenProcess LoadLibraryW Sleep ReadProcessMemory TerminateProcess GetModuleFileNameW CreateFileW GetModuleHandleW GetLastError GetProcAddress VirtualAllocEx CloseHandle DeleteFileW WriteProcessMemory SuspendThread ResumeThread WritePrivateProfileStringW CreateProcessW SetConsoleMode ReadConsoleInputA SetStdHandle SetFilePointer WriteConsoleW IsProcessorFeaturePresent GetStringTypeW HeapFree HeapAlloc GetCommandLineA HeapSetInformation HeapCreate ExitProcess DecodePointer WriteFile GetStdHandle EncodePointer EnterCriticalSection LeaveCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentProcess GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage MultiByteToWideChar RtlUnwind HeapSize HeapReAlloc GetConsoleCP GetConsoleMode FlushFileBuffers LCMapStringW

comdlg32

GetOpenFileNameW

ws2_32

WSAStartup inet_addr WSAGetLastError htons recv bind socket closesocket send listen accept

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_b745a1107bc39177e90fcb4d561aabc4_amadey_elex_redline-stealer_smoke-loader

kernel32

comdlg32

ws2_32

generic