2026-08-24_27b014a7554edfd014d6d638cfed0a64_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-24_27b014a7554edfd014d6d638cfed0a64_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
Size 2.4MB
Sample260825-vesmmscm4w
SHA256 2bd28901f8ab7f9b05a773e318c0ab4d38d2297ee97a7fd41beaee9a52a6a2f9
MD5 27b014a7554edfd014d6d638cfed0a64
SHA1 ed2c9d82c2149d5b52d76bb18c20090e4647a2e0
SHA512 9281ca289170f881792236c4a296dd44afb929ab16bb087e84cb0abb7ed805be1ee3e16217c580944a363e61c5fae78f0cd1b9a80aedd0853eef05f74c3378ea
SSDEEP 49152:/KwXIH99KyVaGbaNpYECFa17SxdlI6M5GtsI6oiv2e27FBuSJxgt6Ju0mnYVhb:DM99+KaNnSa6zmGJwK7/g6mQt
TLSH
T11AC53303248FAD77DA5AD5F0A5A593A28D386C062579328F5784BAC5BFB0F78071F318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-24_27b014a7554edfd014d6d638cfed0a64_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-08-24_27b014a7554edfd014d6d638cfed0a64_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

.exe 2.4MB

2026-08-24_27b014a7554edfd014d6d638cfed0a64_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 42088f3234abbfb21af37437713e7527
SHA256 2bd28901f8ab7f9b05a773e318c0ab4d38d2297ee97a7fd41beaee9a52a6a2f9
MD5 27b014a7554edfd014d6d638cfed0a64
SHA1 ed2c9d82c2149d5b52d76bb18c20090e4647a2e0
SHA512 9281ca289170f881792236c4a296dd44afb929ab16bb087e84cb0abb7ed805be1ee3e16217c580944a363e61c5fae78f0cd1b9a80aedd0853eef05f74c3378ea
SSDEEP 49152:/KwXIH99KyVaGbaNpYECFa17SxdlI6M5GtsI6oiv2e27FBuSJxgt6Ju0mnYVhb:DM99+KaNnSa6zmGJwK7/g6mQt
TLSH
T11AC53303248FAD77DA5AD5F0A5A593A28D386C062579328F5784BAC5BFB0F78071F318
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

comctl32

InitCommonControlsEx

kernel32

CreateFileA RtlMoveMemory VirtualFree VirtualAlloc lstrcmpA GetProcAddress LoadLibraryA GetModuleHandleA lstrcmpiA ReadFile lstrlenA FindFirstFileA SetFilePointer VirtualProtect GetModuleFileNameA LockResource LoadResource FindResourceA GetCommandLineA ExitProcess SetEnvironmentVariableA GetEnvironmentVariableA GetSystemDirectoryA WriteFile CloseHandle lstrcpyA SetLastError FlushInstructionCache GetCurrentProcess VirtualQuery GetStartupInfoA RtlUnwind TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetLastError HeapFree HeapAlloc RaiseException GetModuleHandleW Sleep GetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage GetLocaleInfoA LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW

user32

wsprintfA MessageBoxA

advapi32

RegCloseKey RegOpenKeyExA RegQueryValueExA

shell32

SHGetSpecialFolderPathA

ole32

CoInitialize

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-24_27b014a7554edfd014d6d638cfed0a64_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

comctl32

kernel32

user32

advapi32

shell32

ole32

generic