2026-09-30_99181daec089ef8f2fdafd626a8c92ba_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

General

Target
2026-09-30_99181daec089ef8f2fdafd626a8c92ba_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
Size 419KB
Sample261001-lma8wstdqc
SHA256 1e28c1a930287cbed0a286f9966a650234617192d9cf02d8e043d93091db6909
MD5 99181daec089ef8f2fdafd626a8c92ba
SHA1 0e637561f92cb9d9e975f4aef64c1221ab05498f
SHA512 0eccb75295ec0e6976f9ffa092608a042b887c9ffc490f3cf522024e428e3c9e6842e6dc0b63125658c4c7909f2610e621c7604357b5399d2b4c742fba930597
SSDEEP 6144:SleGtnZ8Suq+e7Hbm+KAM8xYZwoZNTp6GR38XsJ4S0BkBywoqF7qA2:SleGtnZ85qT71KA7xCwMTpGg4cVfF7
TLSH
T1C394021172F2D031F19325758874E7BE1A7FF9662934548F67906A3E2E30EC09E76352
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_99181daec089ef8f2fdafd626a8c92ba_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

File Explorer

2026-09-30_99181daec089ef8f2fdafd626a8c92ba_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

.exe 419KB

2026-09-30_99181daec089ef8f2fdafd626a8c92ba_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

IMPHASH 7220f2b8f04ec1b97c7c8d98e0adef7a
SHA256 1e28c1a930287cbed0a286f9966a650234617192d9cf02d8e043d93091db6909
MD5 99181daec089ef8f2fdafd626a8c92ba
SHA1 0e637561f92cb9d9e975f4aef64c1221ab05498f
SHA512 0eccb75295ec0e6976f9ffa092608a042b887c9ffc490f3cf522024e428e3c9e6842e6dc0b63125658c4c7909f2610e621c7604357b5399d2b4c742fba930597
SSDEEP 6144:SleGtnZ8Suq+e7Hbm+KAM8xYZwoZNTp6GR38XsJ4S0BkBywoqF7qA2:SleGtnZ85qT71KA7xCwMTpGg4cVfF7
TLSH
T1C394021172F2D031F19325758874E7BE1A7FF9662934548F67906A3E2E30EC09E76352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

8223

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ziyemu\kiponetal lazujuyo\cegumecexawat\pegewojob.pdb

kernel32

LoadResource HeapAlloc GetConsoleAliasA GetEnvironmentStringsW AddConsoleAliasW FlushConsoleInputBuffer GetTickCount SetConsoleCursorPosition WriteConsoleW SetLastError GetProcAddress VirtualAlloc BeginUpdateResourceW GetFirmwareEnvironmentVariableW GetAtomNameA LoadLibraryA LocalAlloc GetModuleFileNameA EraseTape FindNextVolumeA lstrcpyW LCMapStringA SetProcessAffinityMask CreateFileW ReadFile EncodePointer DecodePointer GetModuleHandleW ExitProcess GetCommandLineA HeapSetInformation GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection WriteFile GetModuleFileNameW HeapCreate TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId GetLastError InterlockedDecrement RtlUnwind SetFilePointer HeapFree CloseHandle LoadLibraryW FreeEnvironmentStringsW WideCharToMultiByte QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime Sleep GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage CreateFileA SetStdHandle FlushFileBuffers HeapSize RaiseException HeapReAlloc MultiByteToWideChar LCMapStringW GetStringTypeW SetEndOfFile GetProcessHeap

user32

SetCursorPos

gdi32

GetCharWidth32A

advapi32

CloseEventLog

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_99181daec089ef8f2fdafd626a8c92ba_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

kernel32

user32

gdi32

advapi32

generic