2026-09-14_4066df35943c17aef4d51bb9c339464e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

General

Target
2026-09-14_4066df35943c17aef4d51bb9c339464e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 233KB
Sample260914-nd4j7ayflc
SHA256 2e13b89843b5bf880c6ba41af727a37a1f3a0aef19ad5f2724a5f0bb792f2e49
MD5 4066df35943c17aef4d51bb9c339464e
SHA1 c60adb43eb5a8014a47d0bcf26dad2d66c762cc7
SHA512 aa9c84071ebec99913ea14a77ca9d3d3889119a9b9297a5ef5d98ad74e318c72266c013dc32e4e254338a1de360d0926d6178f94f8e0832e75f14e46c3e121ac
SSDEEP 3072:5T38/CRCCConlmFNgBDwUQUMIcNsyMc52FBcBCOGjTSSOSPP/45DXKRTIxb:puCusZQUMIcNVt123eaRT
TLSH
T17534D050BED1FCB3D91386708830C0E5A63F7C53979596D733083BAB6C72291B6AA751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-14_4066df35943c17aef4d51bb9c339464e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-09-14_4066df35943c17aef4d51bb9c339464e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 233KB

2026-09-14_4066df35943c17aef4d51bb9c339464e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH 71666ce513898b08ba38dfa1dc35ec76
SHA256 2e13b89843b5bf880c6ba41af727a37a1f3a0aef19ad5f2724a5f0bb792f2e49
MD5 4066df35943c17aef4d51bb9c339464e
SHA1 c60adb43eb5a8014a47d0bcf26dad2d66c762cc7
SHA512 aa9c84071ebec99913ea14a77ca9d3d3889119a9b9297a5ef5d98ad74e318c72266c013dc32e4e254338a1de360d0926d6178f94f8e0832e75f14e46c3e121ac
SSDEEP 3072:5T38/CRCCConlmFNgBDwUQUMIcNsyMc52FBcBCOGjTSSOSPP/45DXKRTIxb:puCusZQUMIcNVt123eaRT
TLSH
T17534D050BED1FCB3D91386708830C0E5A63F7C53979596D733083BAB6C72291B6AA751
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

18958

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\zumub.pdb

kernel32

ReadConsoleA InterlockedDecrement WaitNamedPipeA SetFirmwareEnvironmentVariableA GetUserDefaultLCID InterlockedCompareExchange GetModuleHandleW EnumCalendarInfoExW SetCommState EnumResourceTypesA TlsSetValue FindResourceExA LoadLibraryW GetVersionExW DeleteVolumeMountPointW GetFileAttributesA SetConsoleMode GetConsoleAliasW HeapValidate SetConsoleCursorPosition GetMailslotInfo WritePrivateProfileStringW GetStringTypeExA CreateJobObjectA GetProfileIntA GetCPInfoExW GetCommState GetLastError InterlockedFlushSList GetProcAddress VirtualAlloc BackupWrite WriteProfileSectionA RemoveDirectoryA SetStdHandle LocalAlloc MoveFileA AddAtomW BeginUpdateResourceA FoldStringA GetModuleHandleA FreeEnvironmentStringsW VirtualProtect OpenEventW QueryPerformanceFrequency GetShortPathNameW GetWindowsDirectoryW AddConsoleAliasA GetConsoleProcessList DebugBreak DeleteFileA VerSetConditionMask GetConsoleAliasesLengthW UnhandledExceptionFilter SetUnhandledExceptionFilter HeapFree MultiByteToWideChar GetCommandLineA GetStartupInfoA Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA TerminateProcess GetCurrentProcess IsDebuggerPresent HeapAlloc HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc GetCPInfo InterlockedIncrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsFree SetLastError GetCurrentThreadId FreeEnvironmentStringsA GetEnvironmentStrings WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind RaiseException LoadLibraryA InitializeCriticalSectionAndSpinCount LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize

user32

CharLowerBuffW

gdi32

SelectPalette GetCharWidthI

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-14_4066df35943c17aef4d51bb9c339464e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

kernel32

user32

gdi32

generic