2026-10-01_f1e02722783911d2a5834d1b3dacc3d1_elex_redline-stealer_rhadamanthys_stop

General

Target
2026-10-01_f1e02722783911d2a5834d1b3dacc3d1_elex_redline-stealer_rhadamanthys_stop
Size 2.1MB
Sample261001-1ll2bszcqa
SHA256 b3385ad58a640f19f12d2d9dfd101464eb054bb7701ac7807b9eca495468365e
MD5 f1e02722783911d2a5834d1b3dacc3d1
SHA1 3b245f2c8644cd970bf3bc71d5710122b7aee3c0
SHA512 995cef5ce9cec79b7385a61668b6da8fea38f62f5520caeae717c0c3b496f99a9ccbc0facc66ef84a86b62b8eee7b23eba5cfc458b12f37495cbf1e66fa4f745
SSDEEP 24576:NI/GRDvhX/MKuWDsRddh/M/H9cgEX/QcuFK9vdqrifgGPpoo:NI/kDvh8MsT/MMXoKvkri4GPao
TLSH
T1A3A533127E42D073E02A73FA4EADC778521B5563023D9603F2498FB54F367D2E72A5A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_f1e02722783911d2a5834d1b3dacc3d1_elex_redline-stealer_rhadamanthys_stop

File Explorer

2026-10-01_f1e02722783911d2a5834d1b3dacc3d1_elex_redline-stealer_rhadamanthys_stop

.exe 2.1MB

2026-10-01_f1e02722783911d2a5834d1b3dacc3d1_elex_redline-stealer_rhadamanthys_stop

IMPHASH ba2c974ed567c90fe365844af978f320
SHA256 b3385ad58a640f19f12d2d9dfd101464eb054bb7701ac7807b9eca495468365e
MD5 f1e02722783911d2a5834d1b3dacc3d1
SHA1 3b245f2c8644cd970bf3bc71d5710122b7aee3c0
SHA512 995cef5ce9cec79b7385a61668b6da8fea38f62f5520caeae717c0c3b496f99a9ccbc0facc66ef84a86b62b8eee7b23eba5cfc458b12f37495cbf1e66fa4f745
SSDEEP 24576:NI/GRDvhX/MKuWDsRddh/M/H9cgEX/QcuFK9vdqrifgGPpoo:NI/kDvh8MsT/MMXoKvkri4GPao
TLSH
T1A3A533127E42D073E02A73FA4EADC778521B5563023D9603F2498FB54F367D2E72A5A2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

9747

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GenerateConsoleCtrlEvent GetExitCodeProcess WaitForSingleObject CreateProcessA SetConsoleCtrlHandler GetModuleFileNameA EnterCriticalSection LeaveCriticalSection GetModuleHandleW Sleep GetProcAddress ExitProcess GetCommandLineA GetStartupInfoA SetHandleCount GetStdHandle GetFileType DeleteCriticalSection TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetLastError HeapFree HeapAlloc GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId WriteFile LoadLibraryA InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind HeapReAlloc VirtualAlloc GetConsoleCP GetConsoleMode FlushFileBuffers LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetFilePointer HeapSize CloseHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA CompareStringA CompareStringW SetEnvironmentVariableA ReadFile SetEndOfFile GetProcessHeap GetFileAttributesA

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_f1e02722783911d2a5834d1b3dacc3d1_elex_redline-stealer_rhadamanthys_stop

kernel32

generic