Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/09/2026, 21:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-01_113322dd9090a58baf1138a40fda3d42_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
General
- Target 2026-09-01_113322dd9090a58baf1138a40fda3d42_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 1.4MB
- Sample260901-1dnvys11cs
- SHA256 c9ebc714f9fe82da7d55584b94ceafd47935938b03c3c071256db3479f880694
- MD5 113322dd9090a58baf1138a40fda3d42
- SHA1 2f5cfbd4770961fdc12ca9525b4d48a50bb684f9
- SHA512 c019e282953a8f2bafe1e681de4a1a82a75d690ddb35282e7dc95afc27e1db6b30afd11efc7507facbd638b02e5487a3c3ee4ccf0af81dd5f9f78d098fa24b55
- SSDEEP 12288:OYmIjE7b+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:K7byxknw4FYnshx8OfVe247
- TLSH T18E65237877D1D072E88A15320625D3B25A2EB8719AB5C007F7AC772FDEB0A90D12E317
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Stealc stealer Version 3 1 IoCs
resource yara_rule behavioral2/memory/4836-11-0x0000000000400000-0x0000000000572000-memory.dmp family_stealc_v3 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-01_113322dd9090a58baf1138a40fda3d42_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-01_113322dd9090a58baf1138a40fda3d42_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_113322dd9090a58baf1138a40fda3d42_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
PID:4836