General
- Target 2026-08-16_cb346656fbdf0868c453848e3ea43dd8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
- Size 16.9MB
- Sample260816-p84n4sybqa
- SHA256 b2b99604b8c157572d74d25d8a8309c190ca01fa98fe41517b04eed3ca612f90
Malware Config
Targets
-
- Target 2026-08-16_cb346656fbdf0868c453848e3ea43dd8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
- Size 16.9MB
- SHA256 b2b99604b8c157572d74d25d8a8309c190ca01fa98fe41517b04eed3ca612f90
Score8/10-
Boot or Logon Autostart Execution: Port Monitors
Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
-
Boot or Logon Autostart Execution: Print Processors
Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Port Monitors
1Print Processors
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
2Port Monitors
1Print Processors
1Event Triggered Execution
1Component Object Model Hijacking
1