2026-09-24_86433bdc48bc9bf2325c43e2cbd6d5b4_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

General

Target
2026-09-24_86433bdc48bc9bf2325c43e2cbd6d5b4_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
Size 676KB
Sample260925-gee5natwcv
SHA256 6ac2b9dbedbd68f0eaf851a772725029d108d8abd4791f372b54b6eab70129da
MD5 86433bdc48bc9bf2325c43e2cbd6d5b4
SHA1 caa020504f6482d462d2db7a1138194ae29321e3
SHA512 2e3d1db759dd6704274f1f5f9c647c2ee762168c8c6b1e645a7dc6e4df7380f745806a904e7fc86c3109f05672c598a9bbae1c2633808e770a75490a0694f58b
SSDEEP 12288:BFs5wX8K95KZTzXo0YK5iBVAnjnKS27GlYgd:BFi2EZTMu5iBSbKS2
TLSH
T1F5E423293D60D4B6F746957ACC37C274A53878334812B9923B86EA4E4FF11D1D63A783
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-24_86433bdc48bc9bf2325c43e2cbd6d5b4_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-09-24_86433bdc48bc9bf2325c43e2cbd6d5b4_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

.exe 676KB

2026-09-24_86433bdc48bc9bf2325c43e2cbd6d5b4_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

IMPHASH f98cc9327e2d65cc6189a693f26e1c1d
SHA256 6ac2b9dbedbd68f0eaf851a772725029d108d8abd4791f372b54b6eab70129da
MD5 86433bdc48bc9bf2325c43e2cbd6d5b4
SHA1 caa020504f6482d462d2db7a1138194ae29321e3
SHA512 2e3d1db759dd6704274f1f5f9c647c2ee762168c8c6b1e645a7dc6e4df7380f745806a904e7fc86c3109f05672c598a9bbae1c2633808e770a75490a0694f58b
SSDEEP 12288:BFs5wX8K95KZTzXo0YK5iBVAnjnKS27GlYgd:BFi2EZTMu5iBSbKS2
TLSH
T1F5E423293D60D4B6F746957ACC37C274A53878334812B9923B86EA4E4FF11D1D63A783
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

6956

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\yote.pdb

kernel32

HeapReAlloc GetLocaleInfoA LoadResource InterlockedIncrement GetEnvironmentStringsW AddConsoleAliasW SetEvent OpenSemaphoreA GetSystemTimeAsFileTime GetCommandLineA WriteFileGather CreateActCtxW GetEnvironmentStrings LeaveCriticalSection GetFileAttributesA ReadFile GetDevicePowerState GetProcAddress FreeUserPhysicalPages VerLanguageNameW WriteConsoleA GetProcessId LocalAlloc RemoveDirectoryW GlobalGetAtomNameW WaitForMultipleObjects EnumResourceTypesW GetModuleFileNameA GetModuleHandleA EraseTape GetStringTypeW ReleaseMutex EndUpdateResourceA LocalSize FindFirstVolumeW FindNextVolumeA lstrcpyW HeapAlloc GetStartupInfoA DeleteCriticalSection EnterCriticalSection HeapFree VirtualFree VirtualAlloc HeapCreate GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle SetHandleCount GetFileType GetLastError SetFilePointer TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent FreeEnvironmentStringsA FreeEnvironmentStringsW WideCharToMultiByte TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetTickCount GetCurrentProcessId InitializeCriticalSectionAndSpinCount RtlUnwind LoadLibraryA SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize GetConsoleOutputCP WriteConsoleW MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA CloseHandle CreateFileA

user32

GetCursorPos

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-24_86433bdc48bc9bf2325c43e2cbd6d5b4_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

kernel32

user32

generic