2026-09-24_2bfe3bfcdbeacb55efeccd76fd465e83_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

General

Target
2026-09-24_2bfe3bfcdbeacb55efeccd76fd465e83_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
Size 676KB
Sample260925-p4e5ysyv5p
SHA256 d4e60ebe0627af3113391fda45e034a06eda418774177578a604c40ea2b9d10b
MD5 2bfe3bfcdbeacb55efeccd76fd465e83
SHA1 897238a5bf01ebf0e8e5a073c08d0added7325c2
SHA512 790a567d7dfd2c4e08544a9f3b67f3790eac21e773df3c05d58470dc797640b2da46c981a2cef00430881803bd3d4f0a2c018e0216a469110867428212cbbd08
SSDEEP 12288:O+yhGzeUKCXLUzJw8ZpClBc8+0flIViZ47piC8iTQ9TIetnKRwcdxn0QPsPk821T:O+yhke6EJxAc2NIViMpLTQ9TXKXn0QP/
TLSH
T1B4E42358F4A0D83DE3C00436E967CAA3057CBB311A64E26B37E943BF5DF6292066E315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-24_2bfe3bfcdbeacb55efeccd76fd465e83_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-09-24_2bfe3bfcdbeacb55efeccd76fd465e83_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

.exe 676KB

2026-09-24_2bfe3bfcdbeacb55efeccd76fd465e83_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

IMPHASH f98cc9327e2d65cc6189a693f26e1c1d
SHA256 d4e60ebe0627af3113391fda45e034a06eda418774177578a604c40ea2b9d10b
MD5 2bfe3bfcdbeacb55efeccd76fd465e83
SHA1 897238a5bf01ebf0e8e5a073c08d0added7325c2
SHA512 790a567d7dfd2c4e08544a9f3b67f3790eac21e773df3c05d58470dc797640b2da46c981a2cef00430881803bd3d4f0a2c018e0216a469110867428212cbbd08
SSDEEP 12288:O+yhGzeUKCXLUzJw8ZpClBc8+0flIViZ47piC8iTQ9TIetnKRwcdxn0QPsPk821T:O+yhke6EJxAc2NIViMpLTQ9TXKXn0QP/
TLSH
T1B4E42358F4A0D83DE3C00436E967CAA3057CBB311A64E26B37E943BF5DF6292066E315
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

6942

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\tatacihek99\rokogojen\cigozami maregenuvow71-y.pdb

kernel32

HeapReAlloc GetLocaleInfoA LoadResource InterlockedIncrement GetEnvironmentStringsW AddConsoleAliasW SetEvent OpenSemaphoreA GetSystemTimeAsFileTime GetCommandLineA WriteFileGather CreateActCtxW GetEnvironmentStrings LeaveCriticalSection GetFileAttributesA ReadFile GetDevicePowerState GetProcAddress FreeUserPhysicalPages VerLanguageNameW WriteConsoleA GetProcessId LocalAlloc RemoveDirectoryW GlobalGetAtomNameW WaitForMultipleObjects EnumResourceTypesW GetModuleFileNameA GetModuleHandleA EraseTape GetStringTypeW ReleaseMutex EndUpdateResourceA LocalSize FindFirstVolumeW FindNextVolumeA lstrcpyW HeapAlloc GetStartupInfoA DeleteCriticalSection EnterCriticalSection HeapFree VirtualFree VirtualAlloc HeapCreate GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle SetHandleCount GetFileType GetLastError SetFilePointer TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent FreeEnvironmentStringsA FreeEnvironmentStringsW WideCharToMultiByte TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetTickCount GetCurrentProcessId InitializeCriticalSectionAndSpinCount RtlUnwind LoadLibraryA SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize GetConsoleOutputCP WriteConsoleW MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA CloseHandle CreateFileA

user32

GetCursorPos

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-24_2bfe3bfcdbeacb55efeccd76fd465e83_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

kernel32

user32

generic