2026-09-04_729f6fb31a6a8479ecadd3329f5f27d8_amadey_elex_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-04_729f6fb31a6a8479ecadd3329f5f27d8_amadey_elex_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 12.4MB
Sample260905-hsnjmayfkh
SHA256 a8a07c253cbd1ba296aedeac2b823949ce7b561b264231401cac69e3f218eca8
MD5 729f6fb31a6a8479ecadd3329f5f27d8
SHA1 44fa7c4d9067d7c206fbcdc130327a1a45ca5f8c
SHA512 aaea7163d3145348b217605392ea8369382b7db2bb8d74e8ed2aa53cebac6e5755427539deae9f9e44cee0c833607b66be5cd0ece6b5aa8acb1de8a26383ca34
SSDEEP 49152:sGEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEc:s
TLSH
T1E3D6016176FE9119F3F79E346AB667981A7BBDA3783481BD0110230A5D32EC18D91F23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-04_729f6fb31a6a8479ecadd3329f5f27d8_amadey_elex_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-09-04_729f6fb31a6a8479ecadd3329f5f27d8_amadey_elex_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 12.4MB

2026-09-04_729f6fb31a6a8479ecadd3329f5f27d8_amadey_elex_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH e381a5a93083caf35e69fd7d319ba0c4
SHA256 a8a07c253cbd1ba296aedeac2b823949ce7b561b264231401cac69e3f218eca8
MD5 729f6fb31a6a8479ecadd3329f5f27d8
SHA1 44fa7c4d9067d7c206fbcdc130327a1a45ca5f8c
SHA512 aaea7163d3145348b217605392ea8369382b7db2bb8d74e8ed2aa53cebac6e5755427539deae9f9e44cee0c833607b66be5cd0ece6b5aa8acb1de8a26383ca34
SSDEEP 49152:sGEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEc:s
TLSH
T1E3D6016176FE9119F3F79E346AB667981A7BBDA3783481BD0110230A5D32EC18D91F23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7857

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetNumaProcessorNode DebugActiveProcessStop GetConsoleAliasExesLengthA SetUnhandledExceptionFilter InterlockedIncrement WaitForSingleObject SetComputerNameW ConnectNamedPipe GetModuleHandleW GetTickCount LoadLibraryW GetLocaleInfoW GetFileAttributesA HeapCreate lstrcpynW FindNextVolumeMountPointW SetConsoleTitleA GetConsoleOutputCP GetLastError TryEnterCriticalSection GetThreadLocale GetProcAddress HeapSize GetAtomNameA CreateHardLinkW FindAtomA GlobalFindAtomW SetSystemTime GetModuleFileNameA SetConsoleTitleW HeapSetInformation GetCurrentDirectoryA SetCalendarInfoA FindAtomW CloseHandle GetLongPathNameW CreateFileA CreateFileW ReadFile FlushFileBuffers HeapReAlloc HeapAlloc GetCommandLineA GetStartupInfoW RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent DecodePointer EncodePointer HeapFree IsProcessorFeaturePresent ExitProcess WriteFile GetStdHandle GetModuleFileNameW EnterCriticalSection LeaveCriticalSection FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage Sleep RtlUnwind MultiByteToWideChar SetStdHandle WriteConsoleW LCMapStringW GetStringTypeW

user32

CopyRect GetMonitorInfoW LoadIconW

advapi32

RegCreateKeyW

ole32

CoTaskMemFree

winhttp

WinHttpOpen

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-04_729f6fb31a6a8479ecadd3329f5f27d8_amadey_elex_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee

kernel32

user32

advapi32

ole32

winhttp

generic