2026-09-04_4f3d78e9a734887ef6347d2146496172_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

General

Target
2026-09-04_4f3d78e9a734887ef6347d2146496172_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
Size 629KB
Sample260905-m85v3add72
SHA256 cb227e24ef9f5bd8cce61dab920933b69d16a911b5dce0b2a0c76c5555661580
MD5 4f3d78e9a734887ef6347d2146496172
SHA1 313dc46abc362869e3354da0b0c1adc44f030e7b
SHA512 f9deef02dab6bff3679505808789dd67d568bd11a941e581c65e9c6361be32273aa58ad458dfd7fad54ea5da487fa8b13191a36c8eb11be7c94378ae37bb4bac
SSDEEP 12288:LHaA65EYjjQucIfMtyB9BbAFX2a7VwdrwtUMa/VWjZgi8I1LQNa5/gtiBGm:LHa6YP5eS9RAFX26KO1a/oj78ycRiBd
TLSH
T17DD42322BA56D072D90196745024C370AA3AED70137A98D3F78A5BBBDA353F15E3B343
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-04_4f3d78e9a734887ef6347d2146496172_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

File Explorer

2026-09-04_4f3d78e9a734887ef6347d2146496172_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

.exe 629KB

2026-09-04_4f3d78e9a734887ef6347d2146496172_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

IMPHASH 4c5f51b90a834834cf0a68ebdf3c7b63
SHA256 cb227e24ef9f5bd8cce61dab920933b69d16a911b5dce0b2a0c76c5555661580
MD5 4f3d78e9a734887ef6347d2146496172
SHA1 313dc46abc362869e3354da0b0c1adc44f030e7b
SHA512 f9deef02dab6bff3679505808789dd67d568bd11a941e581c65e9c6361be32273aa58ad458dfd7fad54ea5da487fa8b13191a36c8eb11be7c94378ae37bb4bac
SSDEEP 12288:LHaA65EYjjQucIfMtyB9BbAFX2a7VwdrwtUMa/VWjZgi8I1LQNa5/gtiBGm:LHa6YP5eS9RAFX26KO1a/oj78ycRiBd
TLSH
T17DD42322BA56D072D90196745024C370AA3AED70137A98D3F78A5BBBDA353F15E3B343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

19812

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ntdll

RtlUnwind

kernel32

HeapFree GetModuleHandleW Sleep GetProcAddress ExitProcess GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualFree VirtualAlloc HeapCreate GetStdHandle GetModuleFileNameA GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId HeapReAlloc LoadLibraryA InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetConsoleCP GetConsoleMode LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW HeapAlloc WaitForMultipleObjects CreateEventA CreateMailslotA LocalAlloc SetEvent GetSystemWindowsDirectoryA GetWindowsDirectoryA CreateFileA CloseHandle GetFileSize SetFilePointer WriteFile FlushFileBuffers ReadFile GetLastError DeviceIoControl

advapi32

StartServiceCtrlDispatcherA RegisterEventSourceA AllocateAndInitializeSid SetEntriesInAclA InitializeSecurityDescriptor SetSecurityDescriptorDacl SetServiceStatus ReportEventA RegDeleteValueA RegCreateKeyExA RegEnumValueA RegCreateKeyA RegSetValueExA RegOpenKeyExA RegQueryValueExA RegCloseKey RegOpenKeyA RegDeleteKeyA RegisterServiceCtrlHandlerA

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-04_4f3d78e9a734887ef6347d2146496172_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

ntdll

kernel32

advapi32

generic