2026-09-30_f7f41e7bdd4464aa5dbaf9e94f0d995d_amadey_elex_gcleaner_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-30_f7f41e7bdd4464aa5dbaf9e94f0d995d_amadey_elex_gcleaner_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
Size 158KB
Sample261001-capfbavves
SHA256 1d33cc5a0c8c3bf2e46a5d17237cd1eda3cf79bbd9fdeee2c26ddc1efdc4f834
MD5 f7f41e7bdd4464aa5dbaf9e94f0d995d
SHA1 f233862c4537c5abbfff2ece174d689150907502
SHA512 12f5a0a8681709d7ec673f80c2f50d714fb74709f6600b82b44d1115fe2bf0388526ab6375e604ca40136124d91565e879c881bcd7555e93c6d5d602b67e1d5f
SSDEEP 1536:gycSeZPJ6/p8bKxGZhecbP3zpnFH9yt0YJCXb+1/frPe2MhyAQukk2Qc7PwbLmAb:dcSeZhcOGIZUArjYcahfTlAXdSA7LQ2
TLSH
T17EF3AE1133E3C472E0A3677064B48BA15A7BB83225F0669B7F98163E5FB03D08EA5757
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_f7f41e7bdd4464aa5dbaf9e94f0d995d_amadey_elex_gcleaner_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

File Explorer

2026-09-30_f7f41e7bdd4464aa5dbaf9e94f0d995d_amadey_elex_gcleaner_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

.exe 158KB

2026-09-30_f7f41e7bdd4464aa5dbaf9e94f0d995d_amadey_elex_gcleaner_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

IMPHASH 3e8df926fd370bd9eed56bdb3961982f
SHA256 1d33cc5a0c8c3bf2e46a5d17237cd1eda3cf79bbd9fdeee2c26ddc1efdc4f834
MD5 f7f41e7bdd4464aa5dbaf9e94f0d995d
SHA1 f233862c4537c5abbfff2ece174d689150907502
SHA512 12f5a0a8681709d7ec673f80c2f50d714fb74709f6600b82b44d1115fe2bf0388526ab6375e604ca40136124d91565e879c881bcd7555e93c6d5d602b67e1d5f
SSDEEP 1536:gycSeZPJ6/p8bKxGZhecbP3zpnFH9yt0YJCXb+1/frPe2MhyAQukk2Qc7PwbLmAb:dcSeZhcOGIZUArjYcahfTlAXdSA7LQ2
TLSH
T17EF3AE1133E3C472E0A3677064B48BA15A7BB83225F0669B7F98163E5FB03D08EA5757
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10770

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\yekefugopibiz kasa58 donajuvo.pdb

kernel32

CommConfigDialogA WaitForSingleObject WriteConsoleInputA CreateHardLinkA GetConsoleAliasesA GetSystemTimeAsFileTime GetConsoleTitleA GetConsoleAliasesLengthW GetHandleInformation GetLongPathNameW GetThreadLocale GetProcAddress VirtualAlloc HeapSize FreeUserPhysicalPages LoadLibraryA LocalAlloc EndUpdateResourceA RaiseException SetFilePointer PulseEvent GetModuleHandleW ExitProcess DecodePointer GetCommandLineA HeapSetInformation GetStartupInfoW EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TerminateProcess GetCurrentProcess HeapAlloc IsProcessorFeaturePresent GetLastError HeapFree CloseHandle LoadLibraryW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement WriteFile GetModuleFileNameW GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId Sleep GetConsoleCP GetConsoleMode RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage SetStdHandle FlushFileBuffers HeapReAlloc WriteConsoleW MultiByteToWideChar LCMapStringW GetStringTypeW CreateFileW

user32

SetCaretPos

gdi32

GetCharWidthFloatA

advapi32

BackupEventLogA

msimg32

GradientFill

Name

.text

Size

79KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

39.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vuk

Size

1024B

Virtual Size

626B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vebazi

Size

1024B

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vexi

Size

512B

Virtual Size

23B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_f7f41e7bdd4464aa5dbaf9e94f0d995d_amadey_elex_gcleaner_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

kernel32

user32

gdi32

advapi32

msimg32

generic