2026-08-09_9c0677b3d40c60967ab5f7317b189f25_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

General

Target
2026-08-09_9c0677b3d40c60967ab5f7317b189f25_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
Size 127KB
Sample260809-tsbqlsbc88
SHA256 3d7163fd4d3888ccae247bf78ba9646c73ac9774af837862c7bb74caea55b0a9
MD5 9c0677b3d40c60967ab5f7317b189f25
SHA1 c4c58b0ee73dd3d4cfb02ef19ffe7e98d9ecf96a
SHA512 fccf50eb8b2c0fa234da2253e458d2ef2ff1369a3fd331ab35298e8105644d3881f666c77ca07772569723404140172c572849bbe23e6a760e94485733d6f313
SSDEEP 3072:tFEDSbca7C7IRJlpPxmA1eeLt5hwhhg5BlTo9X+eY:tFEDUc+BmA4eLrhwhhgpXeY
TLSH
T131D3D0267900C03BC11660750935C2F28E7F793116AAC5977FC917AA9F222E9EA3D34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_9c0677b3d40c60967ab5f7317b189f25_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

File Explorer

2026-08-09_9c0677b3d40c60967ab5f7317b189f25_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

.exe 127KB

2026-08-09_9c0677b3d40c60967ab5f7317b189f25_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

IMPHASH 4749670ac3d28d6761142b0dcb4f5076
SHA256 3d7163fd4d3888ccae247bf78ba9646c73ac9774af837862c7bb74caea55b0a9
MD5 9c0677b3d40c60967ab5f7317b189f25
SHA1 c4c58b0ee73dd3d4cfb02ef19ffe7e98d9ecf96a
SHA512 fccf50eb8b2c0fa234da2253e458d2ef2ff1369a3fd331ab35298e8105644d3881f666c77ca07772569723404140172c572849bbe23e6a760e94485733d6f313
SSDEEP 3072:tFEDSbca7C7IRJlpPxmA1eeLt5hwhhg5BlTo9X+eY:tFEDUc+BmA4eLrhwhhgpXeY
TLSH
T131D3D0267900C03BC11660750935C2F28E7F793116AAC5977FC917AA9F222E9EA3D34B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

7590

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WriteFile DisconnectNamedPipe InterlockedIncrement InterlockedDecrement CreateProcessA WaitForSingleObject GetExitCodeProcess CreateNamedPipeA ConnectNamedPipe CreateEventA GetCurrentProcessId OpenProcess LocalAlloc LocalFree CloseHandle SetEvent ReadFile GetLastError ExitThread ResumeThread CreateThread GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId Sleep ExitProcess HeapFree EnterCriticalSection LeaveCriticalSection GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage LoadLibraryA InitializeCriticalSectionAndSpinCount RtlUnwind HeapAlloc VirtualAlloc HeapReAlloc SetFilePointer GetConsoleCP GetConsoleMode GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW LCMapStringA LCMapStringW HeapSize FlushFileBuffers SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA

advapi32

SetSecurityDescriptorDacl StartServiceCtrlDispatcherA RegisterServiceCtrlHandlerA OpenProcessToken GetTokenInformation AllocateAndInitializeSid EqualSid FreeSid OpenSCManagerA OpenServiceA CloseServiceHandle DeleteService SetServiceStatus InitializeSecurityDescriptor

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_9c0677b3d40c60967ab5f7317b189f25_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

kernel32

advapi32

generic