2026-09-08_ed4524f0f235fdc4b5145ba9bd7f6d30_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

General

Target
2026-09-08_ed4524f0f235fdc4b5145ba9bd7f6d30_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
Size 3.9MB
Sample260908-mtltmsycme
SHA256 5e94f126eb3dd7963501eebd50f1eed5426651dd77b0cf5ec29edb032701aa4f
MD5 ed4524f0f235fdc4b5145ba9bd7f6d30
SHA1 008b43d0dd7d9948d3a849bd9f379563a8aae6ad
SHA512 7ecf4c6491a95e947c1a879ff6971d40092cf04c250eab1178d0066f45032d5af2c2b90bc779fbbab31eb6e211f33a382a93a023f635f2566fcd2b2b7250781d
SSDEEP 98304:q/p675X/pqU4DW/QFerzIynYLpt47nNrum2mzk6lyiUAb:qA7yY/KCspytum2mzRgiDb
TLSH
T191163375FA11C23BC8636DF08B8A49F567B8E9242C32D19F36C91B4EDBF4A505F25221
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-08_ed4524f0f235fdc4b5145ba9bd7f6d30_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

File Explorer

2026-09-08_ed4524f0f235fdc4b5145ba9bd7f6d30_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

.exe 3.9MB

2026-09-08_ed4524f0f235fdc4b5145ba9bd7f6d30_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

IMPHASH 8d92fa1956a6a631c642190121740197
SHA256 5e94f126eb3dd7963501eebd50f1eed5426651dd77b0cf5ec29edb032701aa4f
MD5 ed4524f0f235fdc4b5145ba9bd7f6d30
SHA1 008b43d0dd7d9948d3a849bd9f379563a8aae6ad
SHA512 7ecf4c6491a95e947c1a879ff6971d40092cf04c250eab1178d0066f45032d5af2c2b90bc779fbbab31eb6e211f33a382a93a023f635f2566fcd2b2b7250781d
SSDEEP 98304:q/p675X/pqU4DW/QFerzIynYLpt47nNrum2mzk6lyiUAb:qA7yY/KCspytum2mzRgiDb
TLSH
T191163375FA11C23BC8636DF08B8A49F567B8E9242C32D19F36C91B4EDBF4A505F25221
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

5611

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

shlwapi

PathAddBackslashA PathStripPathA PathRemoveFileSpecA

kernel32

GetModuleFileNameA FindResourceA GetModuleHandleA SizeofResource LoadResource GetTempPathA CreateDirectoryA DeleteFileA CreateFileA WriteFile CloseHandle CreateProcessA WaitForSingleObject RemoveDirectoryA FlushFileBuffers GetTempFileNameA GetCurrentThreadId GetCommandLineA GetStartupInfoA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW Sleep GetProcAddress ExitProcess GetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetLastError GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement HeapCreate VirtualFree HeapFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer GetConsoleCP GetConsoleMode EnterCriticalSection LeaveCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage LoadLibraryA InitializeCriticalSectionAndSpinCount HeapAlloc VirtualAlloc HeapReAlloc RtlUnwind SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize

user32

MessageBoxA

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorA

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-08_ed4524f0f235fdc4b5145ba9bd7f6d30_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

shlwapi

kernel32

user32

advapi32

generic