2026-08-24_54147cb42ce7aad7016ea5086c847e40_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

General

Target
2026-08-24_54147cb42ce7aad7016ea5086c847e40_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 13.5MB
Sample260825-qgkycssfnf
SHA256 4bf9868a5fff25e475db72c59e002696e3db4df092b1b86d9bb6c42ccfd240e6
MD5 54147cb42ce7aad7016ea5086c847e40
SHA1 2209ca5b7c97feaa0c23ef453dd86af4193b2016
SHA512 4728ab72d2f669d174ec26e87181d5310ab60351d14582ae7445a8e7ebafd4466f5306d32c4aba962a413c121456012e3939587bc5a561a2ef4c12e5ae5c665c
SSDEEP 6144:JOVY2venhod1iYYwJ1J1J1J1J1J1J1J1J1J1J1J1J1J1J1J1J1J1J1J1J1J1J1J3:JOV/eG1i
TLSH
T1DBE6A40162E1BC09EEAA4F765E27DFE4252EBC909FB056AF328C3A1F253F1709561351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-24_54147cb42ce7aad7016ea5086c847e40_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-08-24_54147cb42ce7aad7016ea5086c847e40_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 13.5MB

2026-08-24_54147cb42ce7aad7016ea5086c847e40_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH 9ee83ae95581d0f3b452457c3b31d6ac
SHA256 4bf9868a5fff25e475db72c59e002696e3db4df092b1b86d9bb6c42ccfd240e6
MD5 54147cb42ce7aad7016ea5086c847e40
SHA1 2209ca5b7c97feaa0c23ef453dd86af4193b2016
SHA512 4728ab72d2f669d174ec26e87181d5310ab60351d14582ae7445a8e7ebafd4466f5306d32c4aba962a413c121456012e3939587bc5a561a2ef4c12e5ae5c665c
SSDEEP 6144:JOVY2venhod1iYYwJ1J1J1J1J1J1J1J1J1J1J1J1J1J1J1J1J1J1J1J1J1J1J1J3:JOV/eG1i
TLSH
T1DBE6A40162E1BC09EEAA4F765E27DFE4252EBC909FB056AF328C3A1F253F1709561351
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

5552

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLocaleInfoA GetConsoleAliasExesLengthA SetFirmwareEnvironmentVariableA GetComputerNameW UnlockFile GetModuleHandleW GetConsoleAliasesLengthA GetDateFormatA SetCommState GlobalAlloc LoadLibraryW IsValidLocale HeapDestroy FindNextVolumeW IsBadWritePtr GlobalUnfix GetProcAddress EnumCalendarInfoA LoadLibraryA SetCalendarInfoW SetConsoleDisplayMode SetCurrentDirectoryW WaitForMultipleObjects GetModuleFileNameA SetConsoleTitleW FreeEnvironmentStringsW BuildCommDCBA VirtualProtect GetCurrentDirectoryA FindAtomW SetFileAttributesW GetVolumeInformationW LocalFileTimeToFileTime GetProcessHeaps GetFileSize GetCommandLineA GetStartupInfoA RaiseException RtlUnwind TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc GetLastError HeapFree EnterCriticalSection LeaveCriticalSection Sleep ExitProcess WriteFile GetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage VirtualAlloc HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW FlushFileBuffers CreateFileA CloseHandle

user32

GetProcessDefaultLayout

advapi32

ReadEventLogA

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-24_54147cb42ce7aad7016ea5086c847e40_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

kernel32

user32

advapi32

generic