2026-08-21_f757faea7abfd2a8abbcc02276fed90c_amadey_elex_feodo_karagany_redline-stealer_rhadamanthys_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-21_f757faea7abfd2a8abbcc02276fed90c_amadey_elex_feodo_karagany_redline-stealer_rhadamanthys_smoke-loader
Size 96KB
Sample260821-pg389sbd49
SHA256 a1d8c2f36bd6adfd4e1d74308f517a32651d72e3d6b44eec287650fa514b4628
MD5 f757faea7abfd2a8abbcc02276fed90c
SHA1 efa0c7e5149637917993bb5deb2c6a137aefae3b
SHA512 ea26e4147adfd5aede96298b67f14d4d7c22079ade2f8378537710427da37619bef82610f0ad54e1d80ea309afbd08bb3a88338aec8e922b6e2681ff3ac1c143
SSDEEP 1536:RFEdNmSNF1ZVNoh4I545MQ5MSe+dMHPNY5Z7TpyVf94nn2FC9:IdNJNSF+iSlMY5VTp4f902g
TLSH
T1CDA3AE11B651C472E072193019F9C2729B3E7C6366F984C7BB9437BA8F702D09B3979A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables packed with aPLib. 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_aPLib

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-21_f757faea7abfd2a8abbcc02276fed90c_amadey_elex_feodo_karagany_redline-stealer_rhadamanthys_smoke-loader

File Explorer

2026-08-21_f757faea7abfd2a8abbcc02276fed90c_amadey_elex_feodo_karagany_redline-stealer_rhadamanthys_smoke-loader

.exe 96KB

2026-08-21_f757faea7abfd2a8abbcc02276fed90c_amadey_elex_feodo_karagany_redline-stealer_rhadamanthys_smoke-loader

IMPHASH a26c65acecfc0991a1227ee0a69b27d4
SHA256 a1d8c2f36bd6adfd4e1d74308f517a32651d72e3d6b44eec287650fa514b4628
MD5 f757faea7abfd2a8abbcc02276fed90c
SHA1 efa0c7e5149637917993bb5deb2c6a137aefae3b
SHA512 ea26e4147adfd5aede96298b67f14d4d7c22079ade2f8378537710427da37619bef82610f0ad54e1d80ea309afbd08bb3a88338aec8e922b6e2681ff3ac1c143
SSDEEP 1536:RFEdNmSNF1ZVNoh4I545MQ5MSe+dMHPNY5Z7TpyVf94nn2FC9:IdNJNSF+iSlMY5VTp4f902g
TLSH
T1CDA3AE11B651C472E072193019F9C2729B3E7C6366F984C7BB9437BA8F702D09B3979A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects executables packed with aPLib.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13213

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCloseKey RegSetValueExA RegQueryValueExA RegOpenKeyExA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken

user32

wsprintfA

shlwapi

SHDeleteKeyA

ntdll

strstr ZwLoadDriver RtlInitUnicodeString sprintf memcpy memset

kernel32

GetProcessHeap HeapSize CreateFileW GetStringTypeW LCMapStringW HeapReAlloc GetLastError CloseHandle MultiByteToWideChar CreateFileA Process32Next Process32First CreateToolhelp32Snapshot lstrcmpiA lstrlenA WinExec GetFileAttributesA GetSystemDirectoryA GetProcAddress GetModuleHandleA VirtualProtect VirtualFree VirtualAlloc GlobalFree WriteFile SizeofResource LockResource LoadResource FindResourceA GetCurrentProcess Sleep OpenProcess UnmapViewOfFile FlushViewOfFile MapViewOfFile CreateFileMappingA GetFileSize SetEndOfFile SetFilePointer lstrcatA GetWindowsDirectoryA WaitForSingleObject CreateProcessA GetModuleFileNameA CopyFileA ExitProcess DeleteFileA CreateDirectoryA HeapFree GetSystemTimeAsFileTime HeapAlloc GetCommandLineA HeapSetInformation GetStartupInfoW EnterCriticalSection LeaveCriticalSection DecodePointer UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TerminateProcess HeapCreate WideCharToMultiByte GetConsoleCP GetConsoleMode ReadFile GetModuleHandleW GetStdHandle GetModuleFileNameW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection RtlUnwind FreeEnvironmentStringsW GetEnvironmentStringsW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetTickCount GetCurrentProcessId GetCPInfo GetACP GetOEMCP IsValidCodePage SetStdHandle FlushFileBuffers WriteConsoleW LoadLibraryW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-21_f757faea7abfd2a8abbcc02276fed90c_amadey_elex_feodo_karagany_redline-stealer_rhadamanthys_smoke-loader

advapi32

user32

shlwapi

ntdll

kernel32

generic