2026-08-11_79adbf1fa235e5604a1aeacd6a0d2acb_elex_karagany_redline-stealer_rhadamanthys_rifdoor_smoke-loader_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-11_79adbf1fa235e5604a1aeacd6a0d2acb_elex_karagany_redline-stealer_rhadamanthys_rifdoor_smoke-loader_stealc
Size 80KB
Sample260811-n8tcpsself
SHA256 888b418a62824f1ee6a5d1c92836240c9d03e7b3b15cc161dcba864e64999ba6
MD5 79adbf1fa235e5604a1aeacd6a0d2acb
SHA1 3f6fae4dac3d59db61bb7c3c123e90d3ea2c0553
SHA512 56569fc31c04716c617beb1e2fdf7d14d142a731f71429f4a639e141860ccaf7369687a29a92af588e005f0dd34d6a9cb88c49af1975f4b43b1355494e71cdb3
SSDEEP 1536:RLNIP9SaZTbFARlq7jC1OZstZu0TS3lEdUJrkb00wJjZv:RL+ZTZX3BAtTS3lEdUJrkb0nlv
TLSH
T117838D117280C473E0A1143144BAD7B25ABEBC3366F999877B9817FE5E703D1AA39327
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-11_79adbf1fa235e5604a1aeacd6a0d2acb_elex_karagany_redline-stealer_rhadamanthys_rifdoor_smoke-loader_stealc

File Explorer

2026-08-11_79adbf1fa235e5604a1aeacd6a0d2acb_elex_karagany_redline-stealer_rhadamanthys_rifdoor_smoke-loader_stealc

.exe 80KB

2026-08-11_79adbf1fa235e5604a1aeacd6a0d2acb_elex_karagany_redline-stealer_rhadamanthys_rifdoor_smoke-loader_stealc

IMPHASH 587bf55eb237bb0ee3c9d753b5b27e23
SHA256 888b418a62824f1ee6a5d1c92836240c9d03e7b3b15cc161dcba864e64999ba6
MD5 79adbf1fa235e5604a1aeacd6a0d2acb
SHA1 3f6fae4dac3d59db61bb7c3c123e90d3ea2c0553
SHA512 56569fc31c04716c617beb1e2fdf7d14d142a731f71429f4a639e141860ccaf7369687a29a92af588e005f0dd34d6a9cb88c49af1975f4b43b1355494e71cdb3
SSDEEP 1536:RLNIP9SaZTbFARlq7jC1OZstZu0TS3lEdUJrkb00wJjZv:RL+ZTZX3BAtTS3lEdUJrkb0nlv
TLSH
T117838D117280C473E0A1143144BAD7B25ABEBC3366F999877B9817FE5E703D1AA39327
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13951

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\Data\My Projects\Troy Source Code\tcp1st\rifle\Release\rifle.pdb

shlwapi

StrToIntA StrChrA StrStrA

ws2_32

connect WSAStartup gethostname WSAIoctl htons setsockopt WSACleanup recv socket closesocket gethostbyname send WSAGetLastError

wininet

DeleteUrlCacheEntry

advapi32

RegCloseKey GetUserNameA RegOpenKeyExA RegCreateKeyA RegQueryValueExA RegSetValueExA

urlmon

URLOpenBlockingStreamA

shell32

ShellExecuteA

user32

wsprintfA

iphlpapi

GetAdaptersInfo

kernel32

IsProcessorFeaturePresent GetStringTypeW LoadLibraryW HeapSize RtlUnwind SetStdHandle WriteConsoleW CreateFileW FlushFileBuffers CompareStringW SetEnvironmentVariableA LeaveCriticalSection EnterCriticalSection GetConsoleMode GetConsoleCP SetFilePointer HeapReAlloc ExitProcess GetComputerNameA CreateFileA GetFileSize lstrcmpA lstrlenA HeapAlloc HeapFree WaitForSingleObject GetTickCount GetProcessHeap WriteFile GetCommandLineA GlobalAlloc Sleep GetExitCodeProcess CreateProcessA TerminateProcess ReadFile lstrcatA CreateDirectoryA SetCurrentDirectoryA GetLastError OpenMutexA CreatePipe GetModuleFileNameA CreateMutexA GetVersionExA WinExec CloseHandle GetTempPathA lstrcpyA GetSystemTimeAsFileTime HeapSetInformation GetStartupInfoW GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent DecodePointer EncodePointer HeapCreate GetProcAddress GetModuleHandleW GetStdHandle GetModuleFileNameW GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId WideCharToMultiByte LCMapStringW MultiByteToWideChar GetTimeZoneInformation RaiseException FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection QueryPerformanceCounter GetCurrentProcessId

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-11_79adbf1fa235e5604a1aeacd6a0d2acb_elex_karagany_redline-stealer_rhadamanthys_rifdoor_smoke-loader_stealc

shlwapi

ws2_32

wininet

advapi32

urlmon

shell32

user32

iphlpapi

kernel32

generic