2026-09-28_0671779712e5bb5e700c54c0ab0481e8_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

General

Target
2026-09-28_0671779712e5bb5e700c54c0ab0481e8_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
Size 22.8MB
Sample260929-pgkf6azblc
SHA256 257ab6990d8d3e1ebccfc724c2078e463b95af0528c0c439cb9c9dba5de76bb9
MD5 0671779712e5bb5e700c54c0ab0481e8
SHA1 dd469fffb4d572244701bcf16b8f1f31f9a4bca0
SHA512 4ccf7c65f323672ada66c8a2b3a95b5e35fb7feef25c9cb31d127e5966e0063a82395b7c7aff0b8c7f7359deefe2d0c398b86cff3e6f2b1d20e56cd8b92771c6
SSDEEP 393216:mhJ7029QsP/htcstArr6of5MJ7ZWqxPAIgtMIMlFRqd+r0tTFw9s3KL89iKE6NsB:mha2Cs3h5yrrKJBH5lFRqdBTFqDL8E5V
TLSH
T10A373311FA6DD471D7A759B85EA4B630BF3A5D20AF2C02E362803469EE373D853F5248
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-28_0671779712e5bb5e700c54c0ab0481e8_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-09-28_0671779712e5bb5e700c54c0ab0481e8_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

.exe 22.8MB

2026-09-28_0671779712e5bb5e700c54c0ab0481e8_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

IMPHASH d619eda1a774da262071361b928bb2e4
SHA256 257ab6990d8d3e1ebccfc724c2078e463b95af0528c0c439cb9c9dba5de76bb9
MD5 0671779712e5bb5e700c54c0ab0481e8
SHA1 dd469fffb4d572244701bcf16b8f1f31f9a4bca0
SHA512 4ccf7c65f323672ada66c8a2b3a95b5e35fb7feef25c9cb31d127e5966e0063a82395b7c7aff0b8c7f7359deefe2d0c398b86cff3e6f2b1d20e56cd8b92771c6
SSDEEP 393216:mhJ7029QsP/htcstArr6of5MJ7ZWqxPAIgtMIMlFRqd+r0tTFw9s3KL89iKE6NsB:mha2Cs3h5yrrKJBH5lFRqdBTFqDL8E5V
TLSH
T10A373311FA6DD471D7A759B85EA4B630BF3A5D20AF2C02E362803469EE373D853F5248
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX dump on OEP (original entry point)
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

62:5d:4d:92:40:e4:77:56:d7:e5:f9:dc:08:c3:98:b2:14:2d:14:0d:75:48:6e:18:86:bf:da:77:39:16:97:67:e6:db:c8:f9:25:be:c5:e4:71:7f:2a:9c:dc:98:e3:4f

Digest Algorithm

sha384

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=TLauncher Inc.,O=TLauncher Inc.,L=Victoria,C=SC

Chains

Apr 18, 2025

CN=TLauncher Inc.,O=TLauncher Inc.,L=Victoria,C=SC

CN=Trustwave Global Code Signing CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

CN=Trustwave Global Certification Authority,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

PE Signature issue

Digest

e0:59:02:22:b0:a3:0e:b2:51:0a:e9:5e:8b:28:f6:e3:2b:8d:c3:4e:27:41:10:6a:99:b4:e5:e8:63:25:c6:e3

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=TLauncher Inc.,O=TLauncher Inc.,L=Victoria,C=SC

Chains

Apr 18, 2025

CN=TLauncher Inc.,O=TLauncher Inc.,L=Victoria,C=SC

CN=Trustwave Global Code Signing CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

CN=Trustwave Global Certification Authority,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

Subject

CN=TLauncher Inc.,O=TLauncher Inc.,L=Victoria,C=SC

Serial Number

07:7f:22:38:be:42:10:bc:dd:a8:7c:d5:bd:db:90:61:80:9f:32

Issuer

CN=Trustwave Global Code Signing CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 23, 2022 - Feb 2, 2026

Subject

CN=Trustwave Global Code Signing CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

Serial Number

06:ce:82:d9:b3:d4:98:74:56:05:d6:66:6b:6d:6d:99:7b:cb:73

Issuer

CN=Trustwave Global Certification Authority,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Mar 3, 2026

Timespan

Feb 6, 2018 - Aug 21, 2042

Subject

CN=Viking Cloud TWG Timestamping Responder 2022,O=Viking Cloud\, Inc.,C=US

Serial Number

07:71:c2:62:80:b4:da:77:02:03:13:ab:bc:fa:a3:ff:ed:8b:2a

Issuer

CN=Viking Cloud TWG Timestamping CA\, Level 1,O=Viking Cloud\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 10, 2022 - Nov 6, 2033

Subject

CN=Viking Cloud TWG Timestamping CA\, Level 1,O=Viking Cloud\, Inc.,C=US

Serial Number

07:71:c1:bc:fc:08:5f:97:f1:8c:6a:6a:23:c8:d3:7f:08:7d:f9

Issuer

CN=Trustwave Global Certification Authority,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Revoked

Revocation Date

Mar 3, 2026

Timespan

Aug 10, 2022 - Aug 10, 2037

Minor OS version

1

Major OS version

5

Entry point

180224

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA lstrcpyA lstrcatA lstrlenA GetSystemDirectoryA GetProcAddress GetModuleHandleA _lclose GetModuleFileNameA _lread _llseek _lopen _lwrite _lcreat CreateDirectoryA SetCurrentDirectoryA GetDiskFreeSpaceA GetFileAttributesA CompareStringA DeleteFileA GetTempPathA GetCurrentDirectoryA CloseHandle GetExitCodeProcess GetLastError LocalFree GetCurrentProcess MoveFileExA GetStringTypeW MultiByteToWideChar LCMapStringW HeapReAlloc RtlUnwind HeapSize Sleep RemoveDirectoryA FreeLibrary IsValidCodePage GetOEMCP GetModuleHandleW ExitProcess DecodePointer HeapFree HeapAlloc GetCommandLineA HeapSetInformation GetStartupInfoW InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer LoadLibraryW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement WriteFile GetStdHandle GetModuleFileNameW IsProcessorFeaturePresent HeapCreate FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP

user32

TranslateMessage DispatchMessageA PeekMessageA wsprintfA LoadCursorA SetCursor MessageBoxA MsgWaitForMultipleObjects

advapi32

GetTokenInformation OpenProcessToken

shell32

ShellExecuteExA

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-28_0671779712e5bb5e700c54c0ab0481e8_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

PE Signature issue

PE Signature issue

kernel32

user32

advapi32

shell32

generic