2026-08-12_17a8a899cae67ea157318183d546d2fd_amadey_elex_redline-stealer_rhadamanthys_sakula_smoke-loader_stealc_stop

General

Target
2026-08-12_17a8a899cae67ea157318183d546d2fd_amadey_elex_redline-stealer_rhadamanthys_sakula_smoke-loader_stealc_stop
Size 365KB
Sample260812-2pp3tswemc
SHA256 11f02de3d29b2b99c806437d10cc4bc1232cc64fba65521d53e47c44426ba219
MD5 17a8a899cae67ea157318183d546d2fd
SHA1 2a001ba9fc5c56cecdf25f34f3f8558e3fdedc3f
SHA512 0de475c4d70b9e7948fde335ff3d40fa3cee4bb015085374e65883220868eb68e4a62a9329309a97c2b5405388eed22d6562244b8426a654a0625784ed21298c
SSDEEP 3072:UEyw/PL4u+MrhsgZbRZwVTslefk6GIfHT0qMubv6dhpaQdd41/x8dBRVlNN:JL4KXZbRZ2rfHT0qkdRXO6dR
TLSH
T19384D010BD90D839C59284345835C7A5ABAEBC31599849CB37643F6F3E307E16AB9FC2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-12_17a8a899cae67ea157318183d546d2fd_amadey_elex_redline-stealer_rhadamanthys_sakula_smoke-loader_stealc_stop

File Explorer

2026-08-12_17a8a899cae67ea157318183d546d2fd_amadey_elex_redline-stealer_rhadamanthys_sakula_smoke-loader_stealc_stop

.exe 365KB

2026-08-12_17a8a899cae67ea157318183d546d2fd_amadey_elex_redline-stealer_rhadamanthys_sakula_smoke-loader_stealc_stop

IMPHASH 490298ec3d59994d2a12f54c75b4c247
SHA256 11f02de3d29b2b99c806437d10cc4bc1232cc64fba65521d53e47c44426ba219
MD5 17a8a899cae67ea157318183d546d2fd
SHA1 2a001ba9fc5c56cecdf25f34f3f8558e3fdedc3f
SHA512 0de475c4d70b9e7948fde335ff3d40fa3cee4bb015085374e65883220868eb68e4a62a9329309a97c2b5405388eed22d6562244b8426a654a0625784ed21298c
SSDEEP 3072:UEyw/PL4u+MrhsgZbRZwVTslefk6GIfHT0qMubv6dhpaQdd41/x8dBRVlNN:JL4KXZbRZ2rfHT0qkdRXO6dR
TLSH
T19384D010BD90D839C59284345835C7A5ABAEBC31599849CB37643F6F3E307E16AB9FC2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

19013

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GlobalCompact CommConfigDialogA CreateProcessW ClearCommError InterlockedDecrement GetCurrentProcess SetEnvironmentVariableW CreateJobObjectW SetComputerNameW GetTimeFormatA GetCurrencyFormatA GetConsoleAliasExesW EnumTimeFormatsW GetEnvironmentStrings GlobalAlloc SetFileShortNameW LoadLibraryW GetLocaleInfoW ReadConsoleInputA GetCalendarInfoW SetVolumeMountPointA GetFileAttributesA CreateSemaphoreA GetModuleFileNameW CreateActCtxA GetShortPathNameA TlsGetValue InterlockedExchange GetLogicalDriveStringsA GetLastError GetCurrentDirectoryW SetLastError GetProcAddress CreateNamedPipeA DefineDosDeviceA GlobalFree GetTempFileNameA FindClose LoadLibraryA InterlockedExchangeAdd CreateHardLinkW GetNumberFormatW OpenEventA GetCommMask GetModuleFileNameA EnumDateFormatsA GlobalUnWire GetShortPathNameW GetDiskFreeSpaceExA GetVersionExA SetFileAttributesW LCMapStringW VerifyVersionInfoW GetComputerNameA UnhandledExceptionFilter SetUnhandledExceptionFilter HeapAlloc GetStartupInfoW GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapFree VirtualFree VirtualAlloc HeapReAlloc HeapCreate TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId HeapSize TerminateProcess IsDebuggerPresent SetHandleCount GetFileType GetStartupInfoA SetFilePointer FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage ReadFile SetStdHandle WideCharToMultiByte GetConsoleCP GetConsoleMode FlushFileBuffers GetLocaleInfoA GetModuleHandleA RaiseException GetStringTypeA MultiByteToWideChar GetStringTypeW LCMapStringA WriteConsoleA GetConsoleOutputCP WriteConsoleW CloseHandle CreateFileA

gdi32

GetCharWidth32A

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-12_17a8a899cae67ea157318183d546d2fd_amadey_elex_redline-stealer_rhadamanthys_sakula_smoke-loader_stealc_stop

kernel32

gdi32

generic