2026-09-24_5f8e550cfd9d53ef6a52f7d4d2789310_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

General

Target
2026-09-24_5f8e550cfd9d53ef6a52f7d4d2789310_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 235KB
Sample260925-kq693axtc1
SHA256 9e88e3da230ae7d03bde14bc96549dd26ba7c506b2e2548ab48aaabd3834c2fe
MD5 5f8e550cfd9d53ef6a52f7d4d2789310
SHA1 c9013e1992a9c3a63a7ad44856312c89b4bfd018
SHA512 53785a5a83bd7daa76fe94424cbbb1e22033152c69424f34b1830108c813c55569b42b905ef9583cdd109feb38076ec7950b01ff193431370ad92e10ebf3e8cb
SSDEEP 3072:FAf1uy1qQLvAIjpecHWYFy5omp9KM/h3:Fw1u8XLvAOecHWYsy
TLSH
T1AC34AE317A40C832C44E5130493AFFA05A7EFC211D659A8377F93F6EAE722D15A6621F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-24_5f8e550cfd9d53ef6a52f7d4d2789310_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-09-24_5f8e550cfd9d53ef6a52f7d4d2789310_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 235KB

2026-09-24_5f8e550cfd9d53ef6a52f7d4d2789310_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH 7dcbbe9c7ee048ad6c29be29a72766de
SHA256 9e88e3da230ae7d03bde14bc96549dd26ba7c506b2e2548ab48aaabd3834c2fe
MD5 5f8e550cfd9d53ef6a52f7d4d2789310
SHA1 c9013e1992a9c3a63a7ad44856312c89b4bfd018
SHA512 53785a5a83bd7daa76fe94424cbbb1e22033152c69424f34b1830108c813c55569b42b905ef9583cdd109feb38076ec7950b01ff193431370ad92e10ebf3e8cb
SSDEEP 3072:FAf1uy1qQLvAIjpecHWYFy5omp9KM/h3:Fw1u8XLvAOecHWYsy
TLSH
T1AC34AE317A40C832C44E5130493AFFA05A7EFC211D659A8377F93F6EAE722D15A6621F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

9157

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\bokitahomafiye56\bixekidu badidu.pdb

kernel32

GetComputerNameA GetDateFormatW GetNativeSystemInfo SetLocaleInfoA FindActCtxSectionGuid InterlockedDecrement GetProfileSectionA SetEvent SleepEx GetCurrentThread GetConsoleAliasesLengthA SwitchToFiber GetStringTypeExW DnsHostnameToComputerNameW lstrcpynW GetMailslotInfo GetStdHandle GetProcAddress VirtualAlloc PeekConsoleInputW SetFileAttributesA GetAtomNameA UnhandledExceptionFilter LocalAlloc GetModuleFileNameA GetModuleHandleA GetConsoleTitleW GetFileTime ReadConsoleInputW GetConsoleProcessList lstrcpyW LCMapStringW SetUnhandledExceptionFilter GetStartupInfoW EnterCriticalSection LeaveCriticalSection SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection TerminateProcess GetCurrentProcess IsDebuggerPresent HeapAlloc RtlUnwind GetModuleHandleW Sleep ExitProcess GetLastError WriteFile SetFilePointer HeapFree CloseHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime WideCharToMultiByte GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount HeapReAlloc CreateFileA ReadFile GetCPInfo GetACP GetOEMCP IsValidCodePage LoadLibraryA SetStdHandle FlushFileBuffers WriteConsoleA GetConsoleOutputCP WriteConsoleW MultiByteToWideChar SetEndOfFile GetProcessHeap LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize

winhttp

WinHttpCloseHandle

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-24_5f8e550cfd9d53ef6a52f7d4d2789310_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

kernel32

winhttp

generic