2026-08-08_a9182aa3abe12eea67cafac7355919a9_elex_redline-stealer_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_a9182aa3abe12eea67cafac7355919a9_elex_redline-stealer_rhadamanthys_stop
Size 1.3MB
Sample260809-ae8nms1sav
SHA256 01377f7ec784d696c0f4ed408987e6e42eb85d7c7ee31540bdc1fab8a2527efb
MD5 a9182aa3abe12eea67cafac7355919a9
SHA1 831f6eea23643cbe55326a9c30a387f985d44bac
SHA512 e0b1830cc8f8ac65da9621e989b26f7c67a29ddda256c0798945ac5f1f474ca704dfbe38ec4cc038747a5ddf6765b4d536d35226d4355c95bef1cd5831fa8eed
SSDEEP 12288:xVh0Sbh1SNfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SF:f6k1SNfJ4yL/tNCJPXUQrPa
TLSH
T120551257B180D037C9036AB4361CD150CB2ABC611739E183BB416E6B7FF66E65B2A3D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_a9182aa3abe12eea67cafac7355919a9_elex_redline-stealer_rhadamanthys_stop

File Explorer

2026-08-08_a9182aa3abe12eea67cafac7355919a9_elex_redline-stealer_rhadamanthys_stop

.exe 1.3MB

2026-08-08_a9182aa3abe12eea67cafac7355919a9_elex_redline-stealer_rhadamanthys_stop

IMPHASH b8ce2ccbd20b4ca76b4bb0035f2639b9
SHA256 01377f7ec784d696c0f4ed408987e6e42eb85d7c7ee31540bdc1fab8a2527efb
MD5 a9182aa3abe12eea67cafac7355919a9
SHA1 831f6eea23643cbe55326a9c30a387f985d44bac
SHA512 e0b1830cc8f8ac65da9621e989b26f7c67a29ddda256c0798945ac5f1f474ca704dfbe38ec4cc038747a5ddf6765b4d536d35226d4355c95bef1cd5831fa8eed
SSDEEP 12288:xVh0Sbh1SNfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SF:f6k1SNfJ4yL/tNCJPXUQrPa
TLSH
T120551257B180D037C9036AB4361CD150CB2ABC611739E183BB416E6B7FF66E65B2A3D2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10734

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Documents and Settings\Administrator\My Documents\Visual Studio 2008\Projects\SmadavUpdater1472\Release\SmadavSecondaryUpdater.pdb

kernel32

CreateFileA ReadFile WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle RtlUnwind FlushFileBuffers LoadLibraryA GetLocaleInfoA GetSystemTime DeleteFileW GetFileAttributesW CloseHandle WriteFile InitializeCriticalSectionAndSpinCount CreateFileW GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA HeapReAlloc VirtualAlloc HeapSize LeaveCriticalSection GetLastError MultiByteToWideChar GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc RaiseException HeapFree GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCPInfo GetACP GetOEMCP IsValidCodePage Sleep ExitProcess GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode EnterCriticalSection

user32

LoadAcceleratorsW LoadStringW PostQuitMessage TranslateAcceleratorW GetMessageW EndDialog EndPaint BeginPaint DefWindowProcW MessageBoxW DestroyWindow DialogBoxParamW SetTimer UpdateWindow ShowWindow CreateWindowExW RegisterClassExW LoadCursorW LoadIconW DispatchMessageW TranslateMessage

advapi32

RegOpenKeyExW CryptReleaseContext CryptDestroyHash CryptVerifySignatureW CryptHashData CryptCreateHash CryptImportKey CryptAcquireContextW RegQueryValueExW

shell32

ord680 ShellExecuteW SHGetFolderPathW

wininet

InternetOpenUrlW InternetReadFile InternetCloseHandle InternetCheckConnectionW InternetOpenW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_a9182aa3abe12eea67cafac7355919a9_elex_redline-stealer_rhadamanthys_stop

kernel32

user32

advapi32

shell32

wininet

generic