2026-08-10_e20853f80e764ac454323e29420815a7_backswap_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_wapomi

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_e20853f80e764ac454323e29420815a7_backswap_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_wapomi
Size 84KB
Sample260810-3ef8ls1dkf
SHA256 49b25c57bca42b706e51c8cf51304f7f2a36eb2cfa862c9e6177483963a730a6
MD5 e20853f80e764ac454323e29420815a7
SHA1 c259ce23881cf781ff38a79ef1132f383d0ea410
SHA512 b8635f2458063eccf08c768d16d0532b2bdab0622347ebf3a59b653597e5fc05321c09ee13ffa03c70ccf27018c6b6e748f88b93583a453403db185f2b91dee9
SSDEEP 1536:5UXpPR7A04LG0TdxBkbS144OtjShPHTPX7eufvuJJRGCq2iW7z:spPiG0TXBkpn+1DqufvuJfGCH
TLSH
T159838D163682C037D49221340C7AC7A24FBFBE71547A958B77E01ABEEF722C19D2535A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-10_e20853f80e764ac454323e29420815a7_backswap_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_wapomi

File Explorer

2026-08-10_e20853f80e764ac454323e29420815a7_backswap_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_wapomi

.exe 84KB

2026-08-10_e20853f80e764ac454323e29420815a7_backswap_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_wapomi

IMPHASH 27f77888e4c7a52e0337b6969334e23a
SHA256 49b25c57bca42b706e51c8cf51304f7f2a36eb2cfa862c9e6177483963a730a6
MD5 e20853f80e764ac454323e29420815a7
SHA1 c259ce23881cf781ff38a79ef1132f383d0ea410
SHA512 b8635f2458063eccf08c768d16d0532b2bdab0622347ebf3a59b653597e5fc05321c09ee13ffa03c70ccf27018c6b6e748f88b93583a453403db185f2b91dee9
SSDEEP 1536:5UXpPR7A04LG0TdxBkbS144OtjShPHTPX7eufvuJJRGCq2iW7z:spPiG0TXBkpn+1DqufvuJfGCH
TLSH
T159838D163682C037D49221340C7AC7A24FBFBE71547A958B77E01ABEEF722C19D2535A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

90112

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

elbyvcd

VCCDEjectTray VCCDCloseTray VCCDToggleTray PurgeHistory OpenVCCD OpenVCCDLetter VCCDCloseDevice VCCDGetStatus VCCDOpenDeviceW VCCDOpenDevice CloseVCCD VCCDInit

kernel32

GetModuleFileNameA GetCommandLineW GetCommandLineA GetProcessHeap SetEndOfFile HeapSize HeapReAlloc WriteConsoleW lstrlenW lstrcpyA lstrlenA GlobalAlloc GetVersionExA lstrcmpiA WideCharToMultiByte MultiByteToWideChar GetStringTypeW GetLastError HeapFree HeapAlloc HeapSetInformation GetStartupInfoW HeapCreate CloseHandle UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer DecodePointer TerminateProcess GetCurrentProcess EnterCriticalSection LeaveCriticalSection GetProcAddress GetModuleHandleW ExitProcess WriteFile GetStdHandle GetModuleFileNameW ReadFile InitializeCriticalSectionAndSpinCount RtlUnwind IsProcessorFeaturePresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId LCMapStringW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers Sleep LoadLibraryW SetFilePointer CreateFileA CreateFileW

user32

wsprintfA MessageBoxA GetDesktopWindow MessageBoxW wsprintfW

comdlg32

GetOpenFileNameW GetOpenFileNameA

advapi32

RegDeleteKeyA RegOpenKeyExA RegCloseKey RegQueryValueExA

shell32

CommandLineToArgvW

ole32

CoInitialize

Name

.text

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

�v�w�u�

Size

16KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_e20853f80e764ac454323e29420815a7_backswap_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_wapomi

elbyvcd

kernel32

user32

comdlg32

advapi32

shell32

ole32

generic