General
- Target 2026-09-10_64e01b47aee43b2d5026262c22f07b64_amadey_elex_redline-stealer_rhadamanthys_rokrat_smoke-loader_stop_valleyrat
- Size 1.5MB
- Sample260910-tg1klasbpe
- SHA256 1cc0c27149db28c611e0c8e749e69aa0d14d5079aa4c1227a634309cce7288a3
- MD5 64e01b47aee43b2d5026262c22f07b64
- SHA1 5f00a182e1606f5475951aa03749bad548bc4201
- SHA512 0895a556ab886ebd1f405096eaa5dbaf8836975f2353d72368176f6ea0fe48ce36140ccc6cf7e2294fc4eddcede04e9e9bbbf6033ffd38124dc742acbaaac440
- SSDEEP 24576:AfuJGv2ns9XRkZfw5eujMDqMCR+irOh6zxCt7ogRiChcqQQJo:AfGGeWXm5/CR+5ozxUF1hkQu
- TLSH T1707523116D08D43BD87C0CFC05FB9AC95B39CE1C212D7982BBD4AC9D2987684A7DB25B
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-10_64e01b47aee43b2d5026262c22f07b64_amadey_elex_redline-stealer_rhadamanthys_rokrat_smoke-loader_stop_valleyrat.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-10_64e01b47aee43b2d5026262c22f07b64_amadey_elex_redline-stealer_rhadamanthys_rokrat_smoke-loader_stop_valleyrat
- Size 1.5MB
- SHA256 1cc0c27149db28c611e0c8e749e69aa0d14d5079aa4c1227a634309cce7288a3
- MD5 64e01b47aee43b2d5026262c22f07b64
- SHA1 5f00a182e1606f5475951aa03749bad548bc4201
- SHA512 0895a556ab886ebd1f405096eaa5dbaf8836975f2353d72368176f6ea0fe48ce36140ccc6cf7e2294fc4eddcede04e9e9bbbf6033ffd38124dc742acbaaac440
- SSDEEP 24576:AfuJGv2ns9XRkZfw5eujMDqMCR+irOh6zxCt7ogRiChcqQQJo:AfGGeWXm5/CR+5ozxUF1hkQu
- TLSH T1707523116D08D43BD87C0CFC05FB9AC95B39CE1C212D7982BBD4AC9D2987684A7DB25B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.