2026-09-25_b3e93cca7da2dc1d5c60db983967762d_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

General

Target
2026-09-25_b3e93cca7da2dc1d5c60db983967762d_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
Size 69KB
Sample260925-zqcssawgrc
SHA256 77a1c2cba124a5d71b43ab99a593b4da46456fbcbb844171e6f79011e45d1bc4
MD5 b3e93cca7da2dc1d5c60db983967762d
SHA1 71a15f9193eb90c2bac5ebf96490f494b914577b
SHA512 a002280c0f6dba026c684220ba9c5f7b90ecafafc79149b757f4d45f5810ec7cd6e854fb67010e69987db39cd3b8d330578009a3bed4854df1d9cf65910558f3
SSDEEP 1536:kYuWZcSAo2ZXPCP6X+lICL5pX4AN+XWjKELEUGua1Qc:krJX+f5pX4AN+mjKbUu1T
TLSH
T173635B1273C4C5B2F83341744879D661675BBC1627A1428F3E8D7B6E5EB23824ABB31B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-25_b3e93cca7da2dc1d5c60db983967762d_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

File Explorer

2026-09-25_b3e93cca7da2dc1d5c60db983967762d_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

.exe 69KB

2026-09-25_b3e93cca7da2dc1d5c60db983967762d_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

IMPHASH 0bcb9a0c9b5eaeeed27967df3a36d762
SHA256 77a1c2cba124a5d71b43ab99a593b4da46456fbcbb844171e6f79011e45d1bc4
MD5 b3e93cca7da2dc1d5c60db983967762d
SHA1 71a15f9193eb90c2bac5ebf96490f494b914577b
SHA512 a002280c0f6dba026c684220ba9c5f7b90ecafafc79149b757f4d45f5810ec7cd6e854fb67010e69987db39cd3b8d330578009a3bed4854df1d9cf65910558f3
SSDEEP 1536:kYuWZcSAo2ZXPCP6X+lICL5pX4AN+XWjKELEUGua1Qc:krJX+f5pX4AN+mjKbUu1T
TLSH
T173635B1273C4C5B2F83341744879D661675BBC1627A1428F3E8D7B6E5EB23824ABB31B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

13459

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

EndDialog DestroyWindow SendMessageW DialogBoxParamW DefWindowProcW BeginPaint EndPaint PostQuitMessage SetFocus CreateWindowExW ShowWindow UpdateWindow LoadStringW LoadIconW LoadCursorW RegisterClassExW GetMessageW TranslateMessage DispatchMessageW

kernel32

GetStringTypeA LCMapStringW MultiByteToWideChar LCMapStringA GetLocaleInfoA HeapSize GetStringTypeW HeapReAlloc VirtualAlloc ReadFile LoadLibraryA LoadLibraryW GetCurrentDirectoryW GetLastError RtlUnwind DeleteCriticalSection GetCommandLineA GetStartupInfoA SetUnhandledExceptionFilter GetModuleHandleW Sleep GetProcAddress ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapCreate VirtualFree HeapFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage HeapAlloc

gdi32

DeleteObject CreateSolidBrush TextOutA SetBkColor SetTextAlign GetBkColor GetStockObject

comctl32

InitCommonControlsEx

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-25_b3e93cca7da2dc1d5c60db983967762d_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

user32

kernel32

gdi32

comctl32

generic