2026-09-29_db18588f065674cff7532a8ad10ab966_amadey_elex_redline-stealer_rhadamanthys_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_db18588f065674cff7532a8ad10ab966_amadey_elex_redline-stealer_rhadamanthys_smoke-loader
Size 891KB
Sample260929-ss3nnavy2q
SHA256 6e3f76a2f9e91992d3e5bc0716c3458ae5b2577fa0b08c07303e2b6458d40e33
MD5 db18588f065674cff7532a8ad10ab966
SHA1 bba02285fa6dd99ea88cad2959e2cd6f60393306
SHA512 cdd96122f491c95e50b002c53c76c7ff7fe83e693954b680e0e34ab403b7c0e2a991969620d6e4144046b8388b2102da062a2e944015f412f3f8bbd0a173c56c
SSDEEP 24576:yGl5r9EulFOpgxglTiUFQpeaFUygRxJacXX:yGXlF3xpYx00
TLSH
T1CB15231575F84574F1F226389CF19DA20B76BC235970858F3B816F2A0F74AD2E629363
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_db18588f065674cff7532a8ad10ab966_amadey_elex_redline-stealer_rhadamanthys_smoke-loader

File Explorer

2026-09-29_db18588f065674cff7532a8ad10ab966_amadey_elex_redline-stealer_rhadamanthys_smoke-loader

.exe 891KB

2026-09-29_db18588f065674cff7532a8ad10ab966_amadey_elex_redline-stealer_rhadamanthys_smoke-loader

IMPHASH 459c3aa71b327403228988f8c94ecf4e
SHA256 6e3f76a2f9e91992d3e5bc0716c3458ae5b2577fa0b08c07303e2b6458d40e33
MD5 db18588f065674cff7532a8ad10ab966
SHA1 bba02285fa6dd99ea88cad2959e2cd6f60393306
SHA512 cdd96122f491c95e50b002c53c76c7ff7fe83e693954b680e0e34ab403b7c0e2a991969620d6e4144046b8388b2102da062a2e944015f412f3f8bbd0a173c56c
SSDEEP 24576:yGl5r9EulFOpgxglTiUFQpeaFUygRxJacXX:yGXlF3xpYx00
TLSH
T1CB15231575F84574F1F226389CF19DA20B76BC235970858F3B816F2A0F74AD2E629363
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21289

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

mi_exe_stub.pdb

kernel32

GetCommandLineA HeapSetInformation GetStartupInfoW SetUnhandledExceptionFilter GetProcAddress GetModuleHandleW ExitProcess DecodePointer WriteFile GetStdHandle GetModuleFileNameW GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId GetLastError InterlockedDecrement HeapCreate HeapDestroy QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection LoadLibraryW UnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess GetCPInfo GetACP GetOEMCP IsValidCodePage HeapFree Sleep RtlUnwind HeapSize LCMapStringW MultiByteToWideChar GetStringTypeW HeapAlloc HeapReAlloc IsProcessorFeaturePresent FlushFileBuffers WriteConsoleW SetStdHandle GetTempFileNameW lstrlenA FindResourceExW FindResourceW LoadResource SetFilePointerEx CreateDirectoryW CopyFileW SizeofResource FormatMessageW GetVersionExW CreateFileW lstrlenW GetTempPathW RaiseException LockResource RemoveDirectoryW lstrcmpiW CloseHandle DeleteFileW LocalFree CreateProcessW WaitForSingleObject GetExitCodeProcess MapViewOfFile UnmapViewOfFile VirtualQuery CreateFileMappingW SetFilePointer ReadFile GetProcessHeap GetConsoleCP GetConsoleMode

shlwapi

PathAppendW PathQuoteSpacesW

ole32

CoUninitialize CoInitializeEx

shell32

SHGetFolderPathW ord680

user32

wvsprintfW CharLowerBuffW MessageBoxW CharNextA

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_db18588f065674cff7532a8ad10ab966_amadey_elex_redline-stealer_rhadamanthys_smoke-loader

kernel32

shlwapi

ole32

shell32

user32

generic