2026-09-07_aee4097044780df89dc9f72c5272d1be_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop_wapomi

General

Target
2026-09-07_aee4097044780df89dc9f72c5272d1be_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop_wapomi
Size 1.1MB
Sample260908-j7dhmswarf
SHA256 a9b0b14c72cc984aced3f9494be42f0b45803d8fc816449c81ae774f4fd4970d
MD5 aee4097044780df89dc9f72c5272d1be
SHA1 116b730681b60b1e6ef9a61251fba364697c748f
SHA512 0d4a9eb495d2e66a52e7bd7e0753b480bb6823ba663efe4f47af988c0952dc1c0de3c1cb2c9670185897be6941c8f9a3ef6acb9459bb34c9be14781f1b579533
SSDEEP 24576:kfsR8o3JTx4kuyQnYmEopLYf/TZRIG5tbO3HQyTB/kAZYwF8:kc8o312kuyQnYmEIeRIG5t0HQk+Aq/
TLSH
T1F735230334D2C473C08AB1367466D3179BAA28615867694F97F2077A7F302F1F6AA71B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-07_aee4097044780df89dc9f72c5272d1be_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop_wapomi

File Explorer

2026-09-07_aee4097044780df89dc9f72c5272d1be_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop_wapomi

.exe 1.1MB

2026-09-07_aee4097044780df89dc9f72c5272d1be_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop_wapomi

IMPHASH a945bbba5e19a9f29aa1458bdc91ed8a
SHA256 a9b0b14c72cc984aced3f9494be42f0b45803d8fc816449c81ae774f4fd4970d
MD5 aee4097044780df89dc9f72c5272d1be
SHA1 116b730681b60b1e6ef9a61251fba364697c748f
SHA512 0d4a9eb495d2e66a52e7bd7e0753b480bb6823ba663efe4f47af988c0952dc1c0de3c1cb2c9670185897be6941c8f9a3ef6acb9459bb34c9be14781f1b579533
SSDEEP 24576:kfsR8o3JTx4kuyQnYmEopLYf/TZRIG5tbO3HQyTB/kAZYwF8:kc8o312kuyQnYmEIeRIG5t0HQk+Aq/
TLSH
T1F735230334D2C473C08AB1367466D3179BAA28615867694F97F2077A7F302F1F6AA71B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

2293760

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\kiwirebet\ravowokiyajoc-coro\tehonizo\hiwiha51\muga\30\fa.pdb

kernel32

GetProcessIoCounters SetMailslotInfo CreateDirectoryW GetConsoleAliasesA GetConsoleTitleA ReadConsoleW WriteConsoleW GetBinaryTypeW ReplaceFileA CreateDirectoryA GetStdHandle GetCPInfoExW GetLastError GetProcAddress VirtualAlloc GetConsoleAliasesLengthW MoveFileW WriteProfileSectionA EnterCriticalSection GlobalFree LoadLibraryA WriteConsoleA SetConsoleWindowInfo GetModuleHandleA FindFirstChangeNotificationA FreeEnvironmentStringsW VirtualProtect SetCalendarInfoA InterlockedPushEntrySList lstrlenA UnregisterWait HeapFree GetCommandLineA GetStartupInfoA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection HeapReAlloc GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId Sleep ExitProcess WriteFile GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount RtlUnwind RaiseException LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize

advapi32

CloseEventLog

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-07_aee4097044780df89dc9f72c5272d1be_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop_wapomi

kernel32

advapi32

generic