2026-08-17_e4ddb42610f1767c0e4d81660ce4ff32_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

General

Target
2026-08-17_e4ddb42610f1767c0e4d81660ce4ff32_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
Size 115KB
Sample260817-gfx2vsvscy
SHA256 59588defed5f7443d552b4d89ae5130f2f5c618d3c7c91d6cf4f326bd4f57dee
MD5 e4ddb42610f1767c0e4d81660ce4ff32
SHA1 14c4048e0a2242c375dda30f7299152c046dc715
SHA512 fc8a248cbc65fed5083c8842fee1049227cd0b0372b98a4e9a6c91edd44054e2defdec71808101fa4d94c95b2f2f71a65015ffd5b63c66df2996a266d0377d26
SSDEEP 1536:aLL1/hV9z0zFxRoLOUprdm034g5d+oLL1/hV9z0zFxRoLO:aLLlD6zRoLOUppm0I/oLLlD6zRoLO
TLSH
T185C38D12B980C0B2C01185B81466DA516B6FBC322BD751C73B99766F9F323D2D63A35F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-17_e4ddb42610f1767c0e4d81660ce4ff32_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

File Explorer

2026-08-17_e4ddb42610f1767c0e4d81660ce4ff32_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

.exe 115KB

2026-08-17_e4ddb42610f1767c0e4d81660ce4ff32_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

IMPHASH 3d9aac51c16d5bb81bb736f3d49d9286
SHA256 59588defed5f7443d552b4d89ae5130f2f5c618d3c7c91d6cf4f326bd4f57dee
MD5 e4ddb42610f1767c0e4d81660ce4ff32
SHA1 14c4048e0a2242c375dda30f7299152c046dc715
SHA512 fc8a248cbc65fed5083c8842fee1049227cd0b0372b98a4e9a6c91edd44054e2defdec71808101fa4d94c95b2f2f71a65015ffd5b63c66df2996a266d0377d26
SSDEEP 1536:aLL1/hV9z0zFxRoLOUprdm034g5d+oLL1/hV9z0zFxRoLO:aLLlD6zRoLOUppm0I/oLLlD6zRoLO
TLSH
T185C38D12B980C0B2C01185B81466DA516B6FBC322BD751C73B99766F9F323D2D63A35F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

5890

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ExitProcess GetFileSize MapViewOfFile UnmapViewOfFile HeapAlloc GetCurrentProcess HeapFree GetProcessHeap Sleep GetModuleFileNameW CreateFileW SetCurrentDirectoryA VirtualAlloc VirtualAllocEx CreateFileMappingW GetModuleFileNameA CloseHandle GetCurrentProcessId LCMapStringW LCMapStringA GetStringTypeW MultiByteToWideChar GetStringTypeA GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW GetProcAddress WriteFile GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId GetLastError InterlockedDecrement HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection LoadLibraryA InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage HeapReAlloc RtlUnwind HeapSize GetLocaleInfoA WideCharToMultiByte

wininet

HttpOpenRequestW HttpSendRequestW InternetConnectW InternetReadFile InternetOpenW HttpQueryInfoW InternetCloseHandle

shlwapi

PathAppendW PathRemoveFileSpecW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-17_e4ddb42610f1767c0e4d81660ce4ff32_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

kernel32

wininet

shlwapi

generic