2026-09-29_de55d38e01d059ef40309cfd1ce5c703_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

General

Target
2026-09-29_de55d38e01d059ef40309cfd1ce5c703_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
Size 498KB
Sample260929-skd1bsshng
SHA256 2a7b9048b2c84b2b00a385d9806f42e7efc858c9931f3bef0ad635d5b37e6c1a
MD5 de55d38e01d059ef40309cfd1ce5c703
SHA1 192e36e8f14c694a3765cb73dc20784ef4764358
SHA512 70f662356845d4314e28285cc531de99acda06daab3252ed8c83093db52cc30163528673f3f07ba297189db58d4dc0e029d183a8b557b4825fb31dd503f3029b
SSDEEP 12288:jZ4dukwQlO+nOAQHI+VobsVv0QI026+7eztihxLv:jZ4Ees+nOAqlv0Q92662CLv
TLSH
T196B4022234B0D031DBB7967365B0CDA06AB6B73E66B2405B2B9517EC5E213D09B37327
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_de55d38e01d059ef40309cfd1ce5c703_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-09-29_de55d38e01d059ef40309cfd1ce5c703_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

.exe 498KB

2026-09-29_de55d38e01d059ef40309cfd1ce5c703_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

IMPHASH b423274974f58a1d1a63a5242c6dcf99
SHA256 2a7b9048b2c84b2b00a385d9806f42e7efc858c9931f3bef0ad635d5b37e6c1a
MD5 de55d38e01d059ef40309cfd1ce5c703
SHA1 192e36e8f14c694a3765cb73dc20784ef4764358
SHA512 70f662356845d4314e28285cc531de99acda06daab3252ed8c83093db52cc30163528673f3f07ba297189db58d4dc0e029d183a8b557b4825fb31dd503f3029b
SSDEEP 12288:jZ4dukwQlO+nOAQHI+VobsVv0QI026+7eztihxLv:jZ4Ees+nOAqlv0Q92662CLv
TLSH
T196B4022234B0D031DBB7967365B0CDA06AB6B73E66B2405B2B9517EC5E213D09B37327
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

11275

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\mixilisoduhuvu40\xejoy.pdb

kernel32

GetLocaleInfoA LoadResource EndUpdateResourceW InterlockedDecrement GlobalSize GetEnvironmentStringsW WaitForSingleObject SetEvent GetSystemDefaultLCID ReadConsoleW FindActCtxSectionStringA GetCommandLineA GlobalAlloc LeaveCriticalSection GetModuleFileNameW GetDevicePowerState ReleaseSemaphore GetConsoleOutputCP GetProcAddress VerLanguageNameA EnterCriticalSection WriteConsoleA GetProcessId LockResource BeginUpdateResourceA GlobalGetAtomNameW SetSystemTime EnumResourceTypesW GetModuleFileNameA GetModuleHandleA EraseTape FindFirstVolumeW AddConsoleAliasA lstrcpyA GetSystemDefaultLangID HeapAlloc GetLastError HeapReAlloc GetStartupInfoA RaiseException RtlUnwind TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapFree DeleteCriticalSection VirtualFree VirtualAlloc HeapCreate GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle SetHandleCount GetFileType SetFilePointer FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount LoadLibraryA SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers HeapSize GetCPInfo GetACP GetOEMCP IsValidCodePage WriteConsoleW MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW CloseHandle CreateFileA

user32

RealChildWindowFromPoint

gdi32

GetCharWidth32A

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_de55d38e01d059ef40309cfd1ce5c703_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

kernel32

user32

gdi32

generic