2026-08-22_96e5e47bc18e80dae51439b446c5097d_elex_mafia_redline-stealer_rhadamanthys_stealc_stop_tofsee

General

Target
2026-08-22_96e5e47bc18e80dae51439b446c5097d_elex_mafia_redline-stealer_rhadamanthys_stealc_stop_tofsee
Size 1.6MB
Sample260823-e4dxsasfpg
SHA256 c5ad0c6814edaba2b8dc8e5c8bd6cd141b403337d0478b452e17087b1a0efa10
MD5 96e5e47bc18e80dae51439b446c5097d
SHA1 7e964bbede0b97030b47a454e779e98435463cb4
SHA512 875ac45665e4f3c174df1e9fdc15ea5fb859bc424c40c34661b431a18db04b78e3b74c3ded37e2d57d216c343f4dd9a33a9e5e1ae7753c12e5182866db70fcb5
SSDEEP 3072:+6LC+FNu6RzLI3Kc70WYEn2/rQ2uEXDJOxviwYS1ASspHrGu6xHDYpegNPjyGH:fLpFNu6RzYT0m2qCDJ6tYS1AZ6CphPm
TLSH
T1E175AE2172D08072E1A32175C8EAFAB40E7A7D6547E165DF2BD81E7F3E246D2963430E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-22_96e5e47bc18e80dae51439b446c5097d_elex_mafia_redline-stealer_rhadamanthys_stealc_stop_tofsee

File Explorer

2026-08-22_96e5e47bc18e80dae51439b446c5097d_elex_mafia_redline-stealer_rhadamanthys_stealc_stop_tofsee

.exe 1.6MB

2026-08-22_96e5e47bc18e80dae51439b446c5097d_elex_mafia_redline-stealer_rhadamanthys_stealc_stop_tofsee

IMPHASH 3878370365af097ca76422ab275e9044
SHA256 c5ad0c6814edaba2b8dc8e5c8bd6cd141b403337d0478b452e17087b1a0efa10
MD5 96e5e47bc18e80dae51439b446c5097d
SHA1 7e964bbede0b97030b47a454e779e98435463cb4
SHA512 875ac45665e4f3c174df1e9fdc15ea5fb859bc424c40c34661b431a18db04b78e3b74c3ded37e2d57d216c343f4dd9a33a9e5e1ae7753c12e5182866db70fcb5
SSDEEP 3072:+6LC+FNu6RzLI3Kc70WYEn2/rQ2uEXDJOxviwYS1ASspHrGu6xHDYpegNPjyGH:fLpFNu6RzYT0m2qCDJ6tYS1AZ6CphPm
TLSH
T1E175AE2172D08072E1A32175C8EAFAB40E7A7D6547E165DF2BD81E7F3E246D2963430E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

58459

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Projects\NEMESIS\nemesis-gemina\nemesis\bin\carriers\ezlzma_x86_exe.pdb

kernel32

SystemTimeToFileTime GetModuleHandleW Sleep GetProcAddress VirtualAlloc LoadLibraryA VirtualProtect GetSystemTime EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetStringTypeW MultiByteToWideChar LCMapStringW IsValidCodePage GetOEMCP GetACP GetCPInfo GetLocaleInfoW LoadLibraryW InterlockedExchange FreeLibrary SetConsoleCtrlHandler HeapSize EnterCriticalSection GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException RtlUnwind GetLastError HeapReAlloc HeapFree HeapAlloc TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent EncodePointer DecodePointer ExitProcess WriteFile GetStdHandle GetModuleFileNameW GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCurrentThread HeapCreate HeapDestroy QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection FatalAppExitA IsValidLocale

user32

EndPaint DestroyWindow GetMessageA RegisterClassExA PostQuitMessage LoadStringA LoadIconA BeginPaint TranslateMessage TranslateAcceleratorA EndDialog DefWindowProcA LoadAcceleratorsA DispatchMessageA LoadCursorA DialogBoxParamA

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-22_96e5e47bc18e80dae51439b446c5097d_elex_mafia_redline-stealer_rhadamanthys_stealc_stop_tofsee

kernel32

user32

generic