2026-08-09_b822f3136b1cd4567518ec51e1fd4cca_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

General

Target
2026-08-09_b822f3136b1cd4567518ec51e1fd4cca_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
Size 127KB
Sample260809-tkb2eahp6x
SHA256 9c1cebf3c34e6ffe4d26c7bcaf9bd9d3cf5ca8fb750c9ce54f4f2aff7f37bd61
MD5 b822f3136b1cd4567518ec51e1fd4cca
SHA1 9065d7d51f7c42ceecb27f340ecf1fa3190caac5
SHA512 72e92d465ef9af7858b5d2dfc5772c809584b3d45e67753b683e3df26d1c7a8afaa8f3e4b67b256cdf8ef0a932382fbd5a6b2da4b991ab0f71ef6340dfa92c23
SSDEEP 1536:nfqqW/DMFv8I8ReUWflaCoa7CYsIRJuyxk34Os5uzUH7dAaZtNunR95LLZ1rSj:fiDSbca7C7IRJjkIG+5hVuRr7A
TLSH
T1FCD3E0A27910C077C81660781929C5B19B2F7A3116F5D683FFC81B7B4F723D9AA3634A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_b822f3136b1cd4567518ec51e1fd4cca_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

File Explorer

2026-08-09_b822f3136b1cd4567518ec51e1fd4cca_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

.exe 127KB

2026-08-09_b822f3136b1cd4567518ec51e1fd4cca_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

IMPHASH 4749670ac3d28d6761142b0dcb4f5076
SHA256 9c1cebf3c34e6ffe4d26c7bcaf9bd9d3cf5ca8fb750c9ce54f4f2aff7f37bd61
MD5 b822f3136b1cd4567518ec51e1fd4cca
SHA1 9065d7d51f7c42ceecb27f340ecf1fa3190caac5
SHA512 72e92d465ef9af7858b5d2dfc5772c809584b3d45e67753b683e3df26d1c7a8afaa8f3e4b67b256cdf8ef0a932382fbd5a6b2da4b991ab0f71ef6340dfa92c23
SSDEEP 1536:nfqqW/DMFv8I8ReUWflaCoa7CYsIRJuyxk34Os5uzUH7dAaZtNunR95LLZ1rSj:fiDSbca7C7IRJjkIG+5hVuRr7A
TLSH
T1FCD3E0A27910C077C81660781929C5B19B2F7A3116F5D683FFC81B7B4F723D9AA3634A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

7590

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WriteFile DisconnectNamedPipe InterlockedIncrement InterlockedDecrement CreateProcessA WaitForSingleObject GetExitCodeProcess CreateNamedPipeA ConnectNamedPipe CreateEventA GetCurrentProcessId OpenProcess LocalAlloc LocalFree CloseHandle SetEvent ReadFile GetLastError ExitThread ResumeThread CreateThread GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId Sleep ExitProcess HeapFree EnterCriticalSection LeaveCriticalSection GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage LoadLibraryA InitializeCriticalSectionAndSpinCount RtlUnwind HeapAlloc VirtualAlloc HeapReAlloc SetFilePointer GetConsoleCP GetConsoleMode GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW LCMapStringA LCMapStringW HeapSize FlushFileBuffers SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA

advapi32

SetSecurityDescriptorDacl StartServiceCtrlDispatcherA RegisterServiceCtrlHandlerA OpenProcessToken GetTokenInformation AllocateAndInitializeSid EqualSid FreeSid OpenSCManagerA OpenServiceA CloseServiceHandle DeleteService SetServiceStatus InitializeSecurityDescriptor

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_b822f3136b1cd4567518ec51e1fd4cca_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

kernel32

advapi32

generic