General
- Target 2026-08-15_a5b0fae15f9698fb05f584ea340a6916_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_swisyn
- Size 6.4MB
- Sample260815-s8dpgazaje
- SHA256 4b5573f1d2d03f674442b1b8ec9fff72321a98d2867588123f08ad846d3ab792
- MD5 a5b0fae15f9698fb05f584ea340a6916
- SHA1 d0c52024e7cecf6299e651246492d32d90524142
- SHA512 26e0930c09eb90fbb225ef22794a2ed91aea8edffacb4889195c0ba06f9b40bf33360d5476062f7cbe374191ef7ab578058c69a7d67621ce6c3679265f2f7860
- SSDEEP 196608:pwKjLs+UIkzHlAv4X6zQRgiwHLD2LQIX0:yKjaxFFP1iLD2Lnk
- TLSH T12C662333B9109036D26204F3E455C6607E3D79352F604CA7A795EB1A39B8587BBFB20B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-15_a5b0fae15f9698fb05f584ea340a6916_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_swisyn.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-15_a5b0fae15f9698fb05f584ea340a6916_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_swisyn.exe
Resource
win11ltsc2024-20260709-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-15_a5b0fae15f9698fb05f584ea340a6916_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_swisyn
- Size 6.4MB
- SHA256 4b5573f1d2d03f674442b1b8ec9fff72321a98d2867588123f08ad846d3ab792
- MD5 a5b0fae15f9698fb05f584ea340a6916
- SHA1 d0c52024e7cecf6299e651246492d32d90524142
- SHA512 26e0930c09eb90fbb225ef22794a2ed91aea8edffacb4889195c0ba06f9b40bf33360d5476062f7cbe374191ef7ab578058c69a7d67621ce6c3679265f2f7860
- SSDEEP 196608:pwKjLs+UIkzHlAv4X6zQRgiwHLD2LQIX0:yKjaxFFP1iLD2Lnk
- TLSH T12C662333B9109036D26204F3E455C6607E3D79352F604CA7A795EB1A39B8587BBFB20B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies visibility of hidden/system files in Explorer
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2