2026-09-29_3530c7571ad678cc0ba5213c10be5c36_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

General

Target
2026-09-29_3530c7571ad678cc0ba5213c10be5c36_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
Size 424KB
Sample260930-17b39abf55
SHA256 ef3a3db4ca389496433a4f0ca7b804efe21548646679c84f79054b66c55d722c
MD5 3530c7571ad678cc0ba5213c10be5c36
SHA1 24a6fc5c3cf1743f8177fa55b550a75a8b4cfa94
SHA512 8dde4af3772a3e1c931cb20e38b81507fe41a4e8746d5467aa55f33bc1826b9d0fb786d7286229350750de3e109e454aaf2404ab657c6cb6beebffa6aa2f3089
SSDEEP 6144:e3RJl4ViMuibHLz/CUFhw1uBiG8oWGuJEZDKuhomDQZYAkBLJhSZsCnQstVLEa:4l4nHLK1uBip7GKuhomEsJf5I9
TLSH
T1C5941220F611C032D7572672781DD3BAAA2E74B01F738A07FF8C175A5E713C1AAE5662
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_3530c7571ad678cc0ba5213c10be5c36_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-09-29_3530c7571ad678cc0ba5213c10be5c36_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

.exe 424KB

2026-09-29_3530c7571ad678cc0ba5213c10be5c36_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

IMPHASH e96a33a04e8bd156ff22aa66a6083b5e
SHA256 ef3a3db4ca389496433a4f0ca7b804efe21548646679c84f79054b66c55d722c
MD5 3530c7571ad678cc0ba5213c10be5c36
SHA1 24a6fc5c3cf1743f8177fa55b550a75a8b4cfa94
SHA512 8dde4af3772a3e1c931cb20e38b81507fe41a4e8746d5467aa55f33bc1826b9d0fb786d7286229350750de3e109e454aaf2404ab657c6cb6beebffa6aa2f3089
SSDEEP 6144:e3RJl4ViMuibHLz/CUFhw1uBiG8oWGuJEZDKuhomDQZYAkBLJhSZsCnQstVLEa:4l4nHLK1uBip7GKuhomEsJf5I9
TLSH
T1C5941220F611C032D7572672781DD3BAAA2E74B01F738A07FF8C175A5E713C1AAE5662
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

7379

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\gigi\wowejuwedub\fayaheso peyucutadih\ziloyoxetazi.pdb

kernel32

InterlockedIncrement WaitForSingleObject SetEvent GetSystemTimeAsFileTime GetCommandLineA WriteFileGather EnumResourceTypesA GetEnvironmentStrings GlobalAlloc SizeofResource LeaveCriticalSection FindNextVolumeW GetFileAttributesW ReadFile MapUserPhysicalPages CreateActCtxA GetDevicePowerState GetProcAddress VerLanguageNameA RemoveDirectoryA PrepareTape WriteConsoleA GetProcessId GlobalGetAtomNameW WaitForMultipleObjects GetModuleFileNameA GetModuleHandleA EndUpdateResourceA LocalSize FindFirstVolumeW AddConsoleAliasA LocalFree lstrcpyW GetLocaleInfoA GetModuleFileNameW HeapReAlloc GetLastError HeapAlloc GetStartupInfoA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent SetHandleCount GetStdHandle GetFileType DeleteCriticalSection SetFilePointer EnterCriticalSection HeapCreate VirtualFree HeapFree VirtualAlloc GetModuleHandleW Sleep ExitProcess WriteFile FreeEnvironmentStringsA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetTickCount GetCurrentProcessId GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount SetStdHandle RtlUnwind FlushFileBuffers LoadLibraryA GetConsoleOutputCP WriteConsoleW MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW HeapSize CreateFileA CloseHandle

user32

GetCursorPos

gdi32

GetCharWidthFloatA

advapi32

DeregisterEventSource

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_3530c7571ad678cc0ba5213c10be5c36_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

kernel32

user32

gdi32

advapi32

generic