26acee2897ae0496eb141717df8870514f4c7724804b5021b46debf40ddae250

General

Target
2026-08-16_28485358b1b9d12559b265ce86c81557_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 21.5MB
Sample260816-sd9hna1vbw
SHA256 26acee2897ae0496eb141717df8870514f4c7724804b5021b46debf40ddae250
MD5 28485358b1b9d12559b265ce86c81557
SHA1 ea81a2cced1924963dea2275a25afc26181bc313
SHA512 21fb8f63f35221f8fd848b8321487bb13f19ca8360f1ff859915d6fd0c5939be9d40230eadeae7d5cdfa4bcb2ef6d7af6f601c5dd1a0aeb0a178ffcfbb5ff257
SSDEEP 393216:j3FREl5fKf+uyvI+7n53fEik40fmOEQXt+WH4JNpdTDlqf/R:j3FRcuyvvlMik40/+WkTDlop
TLSH
T11437336AE30190F0C8E587F041B60BA24F922D221FD1D9DF2BB9358DEED43E56B79509
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Signatures

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c544-5.dat	UPX
behavioral2/memory/2440-11-0x0000000000400000-0x00000000007CB000-memory.dmp	UPX
behavioral2/memory/2440-28-0x0000000000400000-0x00000000007CB000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
2440	irsetup.exe

Loads dropped DLL 1 IoCs

pid	Process
2440	irsetup.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000e00000001c544-5.dat	upx
behavioral2/memory/2440-11-0x0000000000400000-0x00000000007CB000-memory.dmp	upx
behavioral2/memory/2440-28-0x0000000000400000-0x00000000007CB000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	irsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_28485358b1b9d12559b265ce86c81557_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	irsetup.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2440	irsetup.exe
2440	irsetup.exe
2440	irsetup.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 2440	1168	2026-08-16_28485358b1b9d12559b265ce86c81557_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-16_28485358b1b9d12559b265ce86c81557_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_28485358b1b9d12559b265ce86c81557_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1809266 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\2026-08-16_28485358b1b9d12559b265ce86c81557_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe" "__IRCT:1" "__IRTSS:0" "__IRSID:S-1-5-21-2301830172-776172150-2531349243-1000"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:2440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

irsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Size 1.3MB
SHA256 5ffd4b20dccfb84c8890abdb780184a7651e760aefba4ab0c6fba5b2a81f97d9
MD5 dec931e86140139380ea0df57cd132b6
SHA1 b717fd548382064189c16cb94dda28b1967a5712
SHA512 14d594e88c4a1f0ec8bc1b4fe2d66e26358f907b1106c047ada35d500ca9e608f1ce5a57599453cf10f11f4d9f1948ced9056ce8bd944b16eca7e9b83e8b27af
SSDEEP 24576:8FYGY9+9d/G7P9lkQ/exnzGn4dLsUvqkaT+0BpCCh+PDed:TN26FOnzGn6LJvqkwnpC+m
TLSH
T15C5533D2FB4552F4FDFE48B449538D2287255E379BEF8A132320F91BEA74510B981C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lua5.1.dll

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
Size 318KB
SHA256 12cb9b8f59c00ef40ea8f28bfc59a29f12dc28332bf44b1a5d8d6a8823365650
MD5 b5fc476c1bf08d5161346cc7dd4cb0ba
SHA1 280fac9cf711d93c95f6b80ac97d89cf5853c096
SHA512 17fa97f399287b941e958d2d42fe6adb62700b01d9dbe0c824604e8e06d903b330f9d7d8ffb109bfb7f6742f46e7e9cedad6981f0d94d629b8402d0a0174f697
SSDEEP 6144:ukn2LG5bwf92+0HiDhAqUS0aMkvAvBtAOj+JzOghK:r2x2cdUhZuIBt8xc
TLSH
T12764AE03B283C472D5A500B90569D7BA4E7A79714776D4F7EBD01AAD8E203E0A73738E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zbxt.ico

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\zbxt.ico
Size 66KB
SHA256 9ed482991e74b06bacace098d0dee064a784f8d511d81d72103a73bbd8b9e26f
MD5 bea94107eb0fd0b7fb1f91d1a538b539
SHA1 7b42bcbe596c1aed408f6d6a661f7d5361f87441
SHA512 eb2eadb15ebd5c00eea8d0618d1a3796cb1a0f031a06b489bdbf2e2f0378835f71f0f983d6ba15d9654d183e4d6a061a4e27ecd1afb0360a70a761364d1b09b6
SSDEEP 1536:tJ9Jfw82DoQoC2cz7ie7ocllqsRQOLLLLjL4LsaL7L4L0LnLij:tHJfiuPc3i8ocllqsr3
TLSH
T111633B0BB501F9A9CC359232B687C8A90E0A6C2E44412EF03799F7FE5131655FE8B75B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2440-11-0x0000000000400000-0x00000000007CB000-memory.dmp

Download

memory/2440-28-0x0000000000400000-0x00000000007CB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads