2026-08-09_72c47740d0abe369980705c3c196b3bc_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_72c47740d0abe369980705c3c196b3bc_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc
Size 13.3MB
Sample260809-hhmjkshc54
SHA256 d88b1cac6d129aa7cce6831c784a7d6d091383fd5c8294f068eb49b0934c9624
MD5 72c47740d0abe369980705c3c196b3bc
SHA1 febf7545329e07c58a62c04b6235131a769dc17e
SHA512 263109e4838c51964737d06328954e4773c25a932fece63bb31183be2089c6b446060af7f5ab42d299e2fe665a53be213fc1f40a567b949c5e1f22dd3cb2bbb6
SSDEEP 6144:xjdwkNtEq4I1lZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZh:pyS1
TLSH
T110E6D7642E315483D278DDBD8F6D3B205EED5FF8A959A80F0E588CD58D2A02679DC20F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_72c47740d0abe369980705c3c196b3bc_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc

File Explorer

2026-08-09_72c47740d0abe369980705c3c196b3bc_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc

.exe 13.3MB

2026-08-09_72c47740d0abe369980705c3c196b3bc_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc

IMPHASH ab4e7cd5f0cc458550b95a85516579ec
SHA256 d88b1cac6d129aa7cce6831c784a7d6d091383fd5c8294f068eb49b0934c9624
MD5 72c47740d0abe369980705c3c196b3bc
SHA1 febf7545329e07c58a62c04b6235131a769dc17e
SHA512 263109e4838c51964737d06328954e4773c25a932fece63bb31183be2089c6b446060af7f5ab42d299e2fe665a53be213fc1f40a567b949c5e1f22dd3cb2bbb6
SSDEEP 6144:xjdwkNtEq4I1lZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZh:pyS1
TLSH
T110E6D7642E315483D278DDBD8F6D3B205EED5FF8A959A80F0E588CD58D2A02679DC20F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5952

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateMutexW SetFilePointer GetCurrentActCtx SetHandleInformation GetConsoleTitleA WaitNamedPipeW FindActCtxSectionStringA GetConsoleCP GetFileAttributesA VerifyVersionInfoA HeapQueryInformation GetModuleFileNameW lstrlenW SetDefaultCommConfigA GetLastError GetProcAddress ReadFileEx VerLanguageNameW LoadLibraryA WriteConsoleA LocalAlloc GetNumberFormatW GetTapeParameters GetOEMCP GetStringTypeW VirtualProtect GetWindowsDirectoryW GetPrivateProfileSectionW LCMapStringW DeleteFileA lstrcpyA DecodePointer EncodePointer HeapReAlloc GetCommandLineA HeapSetInformation GetStartupInfoW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess RtlUnwind HeapFree SetHandleCount GetStdHandle GetFileType DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetModuleHandleW SetLastError GetCurrentThreadId InterlockedDecrement HeapCreate HeapAlloc CloseHandle ExitProcess WriteFile GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime Sleep CreateFileA SetStdHandle GetCPInfo GetACP IsValidCodePage GetConsoleMode FlushFileBuffers LoadLibraryW SetEndOfFile GetProcessHeap MultiByteToWideChar ReadFile IsProcessorFeaturePresent WriteConsoleW HeapSize CreateFileW

advapi32

DeregisterEventSource

Name

.text

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

70KB

Virtual Size

1005KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.muce

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.noxavu

Size

1024B

Virtual Size

963B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.suba

Size

1024B

Virtual Size

984B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.cosece

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

55KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13.1MB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_72c47740d0abe369980705c3c196b3bc_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc

kernel32

advapi32

generic