2026-09-20_ef22fd592076975833c8c05829806189_amadey_elex_gcleaner_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

General

Target
2026-09-20_ef22fd592076975833c8c05829806189_amadey_elex_gcleaner_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
Size 10.6MB
Sample260920-2qs6wadf68
SHA256 18c5c868bb5ac27d07e019d1d63f996fc2a84632cc9a5c2c897c42179550b76d
MD5 ef22fd592076975833c8c05829806189
SHA1 afcfcf899f5f9b3a140d2403e7ddda2f4461cc04
SHA512 2124d6d7bf19f05e4d5d9c31680afff170f0a92a70dfb6226282ddcd63524776e3b30e2510940c2f96321ee6b751c17ba8d9d42275bdf867934eea000b5ab74f
SSDEEP 6144:XtRdHbfGeyTf8CJH1ci6aZRVDqQP4n48rMI8gVzuhZIIQFa0lw+QFa0lw+QFa0lQ:XtRdHbfByTU3OTBtP44cMYW
TLSH
T194B67200B6A7D815EAB24934BD38E6F8273BBC979828558B31543F7F38F25416D533A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-20_ef22fd592076975833c8c05829806189_amadey_elex_gcleaner_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

File Explorer

2026-09-20_ef22fd592076975833c8c05829806189_amadey_elex_gcleaner_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

.exe 10.6MB

2026-09-20_ef22fd592076975833c8c05829806189_amadey_elex_gcleaner_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

IMPHASH 9875b68adf5a82da587f07ad683d1acb
SHA256 18c5c868bb5ac27d07e019d1d63f996fc2a84632cc9a5c2c897c42179550b76d
MD5 ef22fd592076975833c8c05829806189
SHA1 afcfcf899f5f9b3a140d2403e7ddda2f4461cc04
SHA512 2124d6d7bf19f05e4d5d9c31680afff170f0a92a70dfb6226282ddcd63524776e3b30e2510940c2f96321ee6b751c17ba8d9d42275bdf867934eea000b5ab74f
SSDEEP 6144:XtRdHbfGeyTf8CJH1ci6aZRVDqQP4n48rMI8gVzuhZIIQFa0lw+QFa0lw+QFa0lQ:XtRdHbfByTU3OTBtP44cMYW
TLSH
T194B67200B6A7D815EAB24934BD38E6F8273BBC979828558B31543F7F38F25416D533A2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

27872

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentProcess SetDefaultCommConfigW SetEnvironmentVariableW CreateJobObjectW UnlockFile CreateHardLinkA GetModuleHandleW GetTickCount FindNextVolumeMountPointA GetNumberFormatA GetWindowsDirectoryA SetCommState GlobalAlloc SetFileShortNameW LoadLibraryW GetCalendarInfoA SetVolumeMountPointA GetConsoleAliasExesLengthW GetFileAttributesW VerifyVersionInfoA GetModuleFileNameW CreateActCtxA GetThreadPriorityBoost LCMapStringA InterlockedExchange GetLogicalDriveStringsA SetLastError GetProcAddress CreateNamedPipeA GetConsoleDisplayMode GetProcessVersion InterlockedDecrement InterlockedExchangeAdd CreateFileMappingW CreateEventW OpenEventA GlobalWire EnumDateFormatsA EnumResourceNamesA VirtualProtect GetCurrentDirectoryA PeekConsoleInputA GetShortPathNameW SetProcessShutdownParameters GetDiskFreeSpaceExA ReadConsoleInputW DebugBreak GetTempPathA EnumCalendarInfoExA LocalFree TlsFree CommConfigDialogW WriteConsoleW CloseHandle FlushFileBuffers GetConsoleMode GetConsoleCP HeapSize EnumCalendarInfoW GetLocaleInfoA SetEndOfFile GetConsoleAliasExesA MultiByteToWideChar HeapAlloc GetLastError HeapReAlloc ExitProcess DecodePointer GetCommandLineA HeapSetInformation GetStartupInfoW GetCPInfo InterlockedIncrement GetACP GetOEMCP IsValidCodePage EncodePointer TlsAlloc TlsGetValue TlsSetValue GetCurrentThreadId UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess HeapFree IsProcessorFeaturePresent WriteFile GetStdHandle HeapCreate ReadFile EnterCriticalSection LeaveCriticalSection SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection SetFilePointer GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringW GetStringTypeW Sleep RaiseException SetStdHandle RtlUnwind CreateFileW

user32

GetMenuStringW DrawStateA LoadMenuW GetWindowLongA CharUpperW GetSysColor GetCaretPos SetMenu

gdi32

CreateDCW GetBitmapBits GetCharWidthFloatA GetCharWidth32A

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-20_ef22fd592076975833c8c05829806189_amadey_elex_gcleaner_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

kernel32

user32

gdi32

generic