2026-09-24_01c83de0c5179027625e8e8edf4e2f54_amadey_elex_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop

General

Target
2026-09-24_01c83de0c5179027625e8e8edf4e2f54_amadey_elex_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop
Size 3.6MB
Sample260925-tkga5a114m
SHA256 923e399c2cb7dca74941106c0c5b3f334e82617a230b1f754b53982db218ea6e
MD5 01c83de0c5179027625e8e8edf4e2f54
SHA1 5a2321e13e4bfc99323f4510c9ed42820b1a4d87
SHA512 835b1da30117b37c0cf0d57d596f5950eb94e022ca1bb02200fe33b3175405bb483087006d8fd4a41fab6aaba7688c50b65e7816ab86614db70e33cfbdf5d190
SSDEEP 98304:nz3KQ5tuUwyusZ5BoMZzUPlMJNkIp7C9:TKQ5UyVJVZ+lMey29
TLSH
T1C1063360F2809035E2D35CB29810F44130FF276B65A457CF77AE6E6D4E306E9BEA6247
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-24_01c83de0c5179027625e8e8edf4e2f54_amadey_elex_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-09-24_01c83de0c5179027625e8e8edf4e2f54_amadey_elex_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop

.exe 3.6MB

2026-09-24_01c83de0c5179027625e8e8edf4e2f54_amadey_elex_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop

IMPHASH d8ad863864e459165b4fe2dc00d190c0
SHA256 923e399c2cb7dca74941106c0c5b3f334e82617a230b1f754b53982db218ea6e
MD5 01c83de0c5179027625e8e8edf4e2f54
SHA1 5a2321e13e4bfc99323f4510c9ed42820b1a4d87
SHA512 835b1da30117b37c0cf0d57d596f5950eb94e022ca1bb02200fe33b3175405bb483087006d8fd4a41fab6aaba7688c50b65e7816ab86614db70e33cfbdf5d190
SSDEEP 98304:nz3KQ5tuUwyusZ5BoMZzUPlMJNkIp7C9:TKQ5UyVJVZ+lMey29
TLSH
T1C1063360F2809035E2D35CB29810F44130FF276B65A457CF77AE6E6D4E306E9BEA6247
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

30986

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\cajate\dakuliraf.pdb

kernel32

LoadLibraryA CreateSemaphoreW RequestWakeupLatency CreateFileA FindActCtxSectionStringW WriteConsoleInputW LoadModule WriteFile FindFirstVolumeMountPointA CreateDirectoryExW GlobalSize WaitForMultipleObjectsEx ReadConsoleInputW GetCurrentProcess FreeUserPhysicalPages WriteConsoleOutputAttribute DebugActiveProcessStop LCMapStringW GetProcAddress GlobalAlloc GetCommandLineW GetBinaryTypeA InterlockedExchange CreateMutexA GetConsoleTitleW SearchPathA FindResourceW FreeConsole EndUpdateResourceW GetLastError SetCommMask SetConsoleCursorInfo GetComputerNameExA GetConsoleAliasW WritePrivateProfileSectionW GlobalFlags GetConsoleAliasesLengthW FindResourceA SetVolumeMountPointW GetModuleHandleA HeapAlloc GetLocaleInfoA GetComputerNameA GetCurrentProcessId DosDateTimeToFileTime EnumResourceLanguagesA _hwrite CreateActCtxA DeleteVolumeMountPointA MoveFileWithProgressW AddRefActCtx WritePrivateProfileStringW GetUserDefaultLangID QueryMemoryResourceNotification WaitForMultipleObjects GetLongPathNameA InterlockedCompareExchange VerifyVersionInfoW EnumCalendarInfoW FindNextFileW EnumTimeFormatsW SetLastError GetConsoleAliasesLengthA SetCriticalSectionSpinCount TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException RtlUnwind HeapFree DeleteFileA GetStartupInfoW GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc SetFilePointer SetHandleCount GetStdHandle GetFileType GetStartupInfoA Sleep ExitProcess GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize InitializeCriticalSectionAndSpinCount SetStdHandle WideCharToMultiByte GetConsoleCP GetConsoleMode FlushFileBuffers LCMapStringA MultiByteToWideChar GetStringTypeA GetStringTypeW WriteConsoleA GetConsoleOutputCP WriteConsoleW CloseHandle

user32

GetMenuBarInfo

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-24_01c83de0c5179027625e8e8edf4e2f54_amadey_elex_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop

kernel32

user32

generic