2026-08-28_7611a1c07c0f6cf197019d93abb4e07c_amadey_elex_redline-stealer_remcos_rhadamanthys_smoke-loader_stop

General

Target
2026-08-28_7611a1c07c0f6cf197019d93abb4e07c_amadey_elex_redline-stealer_remcos_rhadamanthys_smoke-loader_stop
Size 360KB
Sample260828-rfekmayfjd
SHA256 3029fef910c0d656451901b97c52bcb19e8c013814d88869b91fff2b04171895
MD5 7611a1c07c0f6cf197019d93abb4e07c
SHA1 07e5f19aed586d35bf90d64b7021e018d6d70f8b
SHA512 be401b439d0e14dbd0894f73acf216f69eef6903a7ba8345225088b5d6e883460baa222662a4e9456c493c976a029d81c1cf4df273fd6b87f0f70f2ef89ccc98
SSDEEP 6144:CRUam+DT21C+Q7rntuf+6lB0Px1eAA7Tetn:KU/aTB7rn+GQAAXUn
TLSH
T154741A4352E17C98F6264B729E1EC6ECB71EF2508E197B6922189E1F04F22B2C173F55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-28_7611a1c07c0f6cf197019d93abb4e07c_amadey_elex_redline-stealer_remcos_rhadamanthys_smoke-loader_stop

File Explorer

2026-08-28_7611a1c07c0f6cf197019d93abb4e07c_amadey_elex_redline-stealer_remcos_rhadamanthys_smoke-loader_stop

.exe 360KB

2026-08-28_7611a1c07c0f6cf197019d93abb4e07c_amadey_elex_redline-stealer_remcos_rhadamanthys_smoke-loader_stop

IMPHASH 0f907acfe861920cd55775c62f670cb2
SHA256 3029fef910c0d656451901b97c52bcb19e8c013814d88869b91fff2b04171895
MD5 7611a1c07c0f6cf197019d93abb4e07c
SHA1 07e5f19aed586d35bf90d64b7021e018d6d70f8b
SHA512 be401b439d0e14dbd0894f73acf216f69eef6903a7ba8345225088b5d6e883460baa222662a4e9456c493c976a029d81c1cf4df273fd6b87f0f70f2ef89ccc98
SSDEEP 6144:CRUam+DT21C+Q7rntuf+6lB0Px1eAA7Tetn:KU/aTB7rn+GQAAXUn
TLSH
T154741A4352E17C98F6264B729E1EC6ECB71EF2508E197B6922189E1F04F22B2C173F55
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

25148

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\simevev\hi.pdb

kernel32

AddConsoleAliasW GetComputerNameW GetModuleHandleW GetNumberFormatA ReadConsoleW EnumTimeFormatsA EnumResourceTypesA SetProcessPriorityBoost ActivateActCtx GetCalendarInfoA GetSystemWindowsDirectoryA HeapCreate EnumSystemCodePagesA FindNextVolumeW GetConsoleAliasW Beep GetModuleFileNameW GetConsoleFontSize CreateActCtxA GetACP lstrlenW GlobalUnlock EnumSystemLocalesA SetLastError GetProcAddress GetLongPathNameA VirtualAlloc HeapSize IsBadHugeWritePtr SetComputerNameW WriteProfileSectionA RemoveDirectoryA LoadLibraryA WriteConsoleA InterlockedExchangeAdd LocalAlloc QueryDosDeviceW WriteProfileSectionW AddAtomA GetDefaultCommConfigA SetConsoleCursorInfo GetConsoleTitleW GetShortPathNameW GetCPInfoExA GetDiskFreeSpaceExW FindAtomW GetWindowsDirectoryW DeleteTimerQueueTimer GetTempPathA EnumCalendarInfoExA SuspendThread CreateFileA CloseHandle WriteConsoleW GetConsoleOutputCP SetStdHandle FlushFileBuffers GetModuleHandleA WaitForSingleObject GetCurrentActCtx ReadConsoleA lstrlenA FindResourceExW BeginUpdateResourceW InterlockedIncrement InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection MultiByteToWideChar GetCommandLineA GetStartupInfoA RaiseException RtlUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetLastError HeapFree TerminateProcess GetCurrentProcess IsDebuggerPresent HeapAlloc TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId ExitProcess GetCPInfo GetOEMCP IsValidCodePage SetHandleCount GetStdHandle GetFileType WriteFile GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapReAlloc GetLocaleInfoA GetStringTypeA GetStringTypeW InitializeCriticalSectionAndSpinCount LCMapStringA LCMapStringW SetFilePointer GetConsoleCP GetConsoleMode

user32

ToAsciiEx ChangeMenuA CharLowerBuffW SetParent CreateAcceleratorTableW GetWindowLongA GetSysColorBrush GetKeyNameTextW GetMenuInfo

gdi32

GetCharWidthA GetColorAdjustment GetCharABCWidthsW

advapi32

BackupEventLogW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-28_7611a1c07c0f6cf197019d93abb4e07c_amadey_elex_redline-stealer_remcos_rhadamanthys_smoke-loader_stop

kernel32

user32

gdi32

advapi32

generic