2026-08-21_80224f842c0aaa2fcb13e6ef9e5983f9_elex_mafia_redline-stealer_rhadamanthys_stealc_stop_tofsee

General

Target
2026-08-21_80224f842c0aaa2fcb13e6ef9e5983f9_elex_mafia_redline-stealer_rhadamanthys_stealc_stop_tofsee
Size 732KB
Sample260821-b49snstygt
SHA256 a5f7a9678cee715b831464900085c0e7f16e96cf60b666d8b478e35569a8fc35
MD5 80224f842c0aaa2fcb13e6ef9e5983f9
SHA1 30965f7b95a65af3b858010409489e417cecaec9
SHA512 3450687e64d2370cf41b2a48541e6f889c37b71b25a3e10791757e07e454268a84e3b5e9842c473d22776c5e9948819691942e43a5b0eaf9d44d20abe547324f
SSDEEP 3072:+6LC+FNu6RzLI3Kc70WYEn2/rQ2uEXDJOxviwYS1ASspHrGu6xHDYpegNPjyGH:fLpFNu6RzYT0m2qCDJ6tYS1AZ6CphPm
TLSH
T165F4AE2172D08072E1A32175C8EAFAB40E7A7D6547E165DF2BD81E7F3E246D2963430E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-21_80224f842c0aaa2fcb13e6ef9e5983f9_elex_mafia_redline-stealer_rhadamanthys_stealc_stop_tofsee

File Explorer

2026-08-21_80224f842c0aaa2fcb13e6ef9e5983f9_elex_mafia_redline-stealer_rhadamanthys_stealc_stop_tofsee

.exe 732KB

2026-08-21_80224f842c0aaa2fcb13e6ef9e5983f9_elex_mafia_redline-stealer_rhadamanthys_stealc_stop_tofsee

IMPHASH 3878370365af097ca76422ab275e9044
SHA256 a5f7a9678cee715b831464900085c0e7f16e96cf60b666d8b478e35569a8fc35
MD5 80224f842c0aaa2fcb13e6ef9e5983f9
SHA1 30965f7b95a65af3b858010409489e417cecaec9
SHA512 3450687e64d2370cf41b2a48541e6f889c37b71b25a3e10791757e07e454268a84e3b5e9842c473d22776c5e9948819691942e43a5b0eaf9d44d20abe547324f
SSDEEP 3072:+6LC+FNu6RzLI3Kc70WYEn2/rQ2uEXDJOxviwYS1ASspHrGu6xHDYpegNPjyGH:fLpFNu6RzYT0m2qCDJ6tYS1AZ6CphPm
TLSH
T165F4AE2172D08072E1A32175C8EAFAB40E7A7D6547E165DF2BD81E7F3E246D2963430E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

58459

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Projects\NEMESIS\nemesis-gemina\nemesis\bin\carriers\ezlzma_x86_exe.pdb

kernel32

SystemTimeToFileTime GetModuleHandleW Sleep GetProcAddress VirtualAlloc LoadLibraryA VirtualProtect GetSystemTime EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetStringTypeW MultiByteToWideChar LCMapStringW IsValidCodePage GetOEMCP GetACP GetCPInfo GetLocaleInfoW LoadLibraryW InterlockedExchange FreeLibrary SetConsoleCtrlHandler HeapSize EnterCriticalSection GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException RtlUnwind GetLastError HeapReAlloc HeapFree HeapAlloc TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent EncodePointer DecodePointer ExitProcess WriteFile GetStdHandle GetModuleFileNameW GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCurrentThread HeapCreate HeapDestroy QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection FatalAppExitA IsValidLocale

user32

EndPaint DestroyWindow GetMessageA RegisterClassExA PostQuitMessage LoadStringA LoadIconA BeginPaint TranslateMessage TranslateAcceleratorA EndDialog DefWindowProcA LoadAcceleratorsA DispatchMessageA LoadCursorA DialogBoxParamA

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-21_80224f842c0aaa2fcb13e6ef9e5983f9_elex_mafia_redline-stealer_rhadamanthys_stealc_stop_tofsee

kernel32

user32

generic