2026-08-10_08e5f789ef9c463edbe2abcbea7e9f53_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

General

Target
2026-08-10_08e5f789ef9c463edbe2abcbea7e9f53_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
Size 685KB
Sample260810-rhb8aawshw
SHA256 8352374ba27f341aa156cfc345aec65ab17b3e95d5fb408e4224811feeae1b65
MD5 08e5f789ef9c463edbe2abcbea7e9f53
SHA1 ccb61dc8e33fefc1f2881931073b091a894cdbbe
SHA512 a5c1ba6f8e49bd2b9dbcd09fbe9966c0ac1d484be65e12413c58e12ee3b7ea9a1ee4dbe548a9727af33025e9b02821539a449f85a02ddc734a36930e46728df3
SSDEEP 12288:SDz8I1E3vhLKJyw097PzmbunhHcYbtmACAY7uKNmY6unWC4yZ7MkIVlIDmcVn:oz8zWJywo3OuFZPtYSomF4WS7MzKmc
TLSH
T155E412657D90C076E177C8306826DAB4AA6A7C63B964C27B3787277EEC322C19F15307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-10_08e5f789ef9c463edbe2abcbea7e9f53_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-08-10_08e5f789ef9c463edbe2abcbea7e9f53_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

.exe 685KB

2026-08-10_08e5f789ef9c463edbe2abcbea7e9f53_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 77ef11329231bbbdbab7a2176724deec
SHA256 8352374ba27f341aa156cfc345aec65ab17b3e95d5fb408e4224811feeae1b65
MD5 08e5f789ef9c463edbe2abcbea7e9f53
SHA1 ccb61dc8e33fefc1f2881931073b091a894cdbbe
SHA512 a5c1ba6f8e49bd2b9dbcd09fbe9966c0ac1d484be65e12413c58e12ee3b7ea9a1ee4dbe548a9727af33025e9b02821539a449f85a02ddc734a36930e46728df3
SSDEEP 12288:SDz8I1E3vhLKJyw097PzmbunhHcYbtmACAY7uKNmY6unWC4yZ7MkIVlIDmcVn:oz8zWJywo3OuFZPtYSomF4WS7MzKmc
TLSH
T155E412657D90C076E177C8306826DAB4AA6A7C63B964C27B3787277EEC322C19F15307
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

16069

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\toza1-yebupagupatam83\dosonuhehamo\wixer\hegegano\gasodey.pdb

kernel32

WriteConsoleInputW SetFilePointer PeekNamedPipe SetConsoleTextAttribute ReadConsoleA InterlockedDecrement GetLogicalDriveStringsW GlobalLock SetVolumeMountPointW ConnectNamedPipe FreeEnvironmentStringsA GetTickCount LoadLibraryW SizeofResource HeapDestroy GetFileAttributesW FileTimeToSystemTime GetGeoInfoA CreateFileW SetThreadPriority GetShortPathNameA GetLastError SetLastError FindFirstChangeNotificationW VirtualAlloc BackupWrite InterlockedExchangeAdd CreateHardLinkW BeginUpdateResourceA SetProcessWorkingSetSize OpenJobObjectW FoldStringW GetModuleFileNameA GetModuleHandleA EnumResourceNamesA FindNextFileW OpenSemaphoreW FindFirstVolumeA GetConsoleProcessList ReadConsoleOutputCharacterW FindNextVolumeA GetProcessHeap SetEndOfFile GetThreadContext GetTempFileNameW GetDateFormatW GetProcAddress UnhandledExceptionFilter SetUnhandledExceptionFilter HeapFree GetCommandLineA GetStartupInfoA GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle TerminateProcess GetCurrentProcess IsDebuggerPresent HeapAlloc WideCharToMultiByte SetHandleCount GetFileType DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapCreate VirtualFree HeapReAlloc RtlUnwind MultiByteToWideChar ReadFile GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime LoadLibraryA InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage CloseHandle CreateFileA SetStdHandle HeapSize GetLocaleInfoA WriteConsoleA GetConsoleOutputCP WriteConsoleW LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW FlushFileBuffers

user32

GetMessageExtraInfo GetClassInfoExW LoadMenuW CharToOemBuffA

gdi32

GetColorAdjustment

advapi32

InitiateSystemShutdownA RegOpenKeyA

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_08e5f789ef9c463edbe2abcbea7e9f53_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

kernel32

user32

gdi32

advapi32

generic