2026-09-30_968b847c6a2bbcb336a8c534b5d1a43a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

General

Target
2026-09-30_968b847c6a2bbcb336a8c534b5d1a43a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
Size 592KB
Sample261001-ls51fsvale
SHA256 22daed670d7371da5629b023d221ce08f8dcadc124bb72261488a3d2f7b37599
MD5 968b847c6a2bbcb336a8c534b5d1a43a
SHA1 c825d1fc6f9a204f33cc384298dda17c648314f9
SHA512 ef2f905f6eab18956349f36865b003e1438eb4925a17b21c7b01b030e6c2299ddba5cef7a5c7b8e773de892e08612a008196a49abedb5c05a793d0348081ece7
SSDEEP 12288:gM69CWgmtw+y0DAx8tE2eeRgEMRzjSSVVOlK8T0VCIKDM:gM60Hm6xxxSEreRgjNSvKFAIn
TLSH
T1CFD4130C3C81E437C0AA0872CC49D9C4EB59BDE1FA59DE872756273D8AF36A45B13287
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_968b847c6a2bbcb336a8c534b5d1a43a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-09-30_968b847c6a2bbcb336a8c534b5d1a43a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

.exe 592KB

2026-09-30_968b847c6a2bbcb336a8c534b5d1a43a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 3cd0350cb20713093b4eb51a8785dabd
SHA256 22daed670d7371da5629b023d221ce08f8dcadc124bb72261488a3d2f7b37599
MD5 968b847c6a2bbcb336a8c534b5d1a43a
SHA1 c825d1fc6f9a204f33cc384298dda17c648314f9
SHA512 ef2f905f6eab18956349f36865b003e1438eb4925a17b21c7b01b030e6c2299ddba5cef7a5c7b8e773de892e08612a008196a49abedb5c05a793d0348081ece7
SSDEEP 12288:gM69CWgmtw+y0DAx8tE2eeRgEMRzjSSVVOlK8T0VCIKDM:gM60Hm6xxxSEreRgjNSvKFAIn
TLSH
T1CFD4130C3C81E437C0AA0872CC49D9C4EB59BDE1FA59DE872756273D8AF36A45B13287
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

7000

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\biyubunun\ziwividibim\bimejudotax.pdb

kernel32

LoadResource UpdateResourceA InterlockedIncrement GetEnvironmentStringsW SetEvent OpenSemaphoreA GetSystemTimeAsFileTime GetCommandLineA WriteFileGather CreateActCtxW EnumResourceTypesA GlobalAlloc LeaveCriticalSection GetFileAttributesA FindNextVolumeW ReadFile GetLocaleInfoA GetDevicePowerState GetProcAddress HeapSize VerLanguageNameA RemoveDirectoryA FreeUserPhysicalPages GlobalGetAtomNameA PrepareTape WriteConsoleA GetProcessId WaitForMultipleObjects GetModuleFileNameA GetModuleHandleA ReleaseMutex EndUpdateResourceA FindFirstVolumeW AddConsoleAliasA lstrcpyW HeapReAlloc HeapAlloc GetStartupInfoA DeleteCriticalSection EnterCriticalSection HeapFree VirtualFree VirtualAlloc HeapCreate GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle SetHandleCount GetFileType GetLastError SetFilePointer TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetTickCount GetCurrentProcessId InitializeCriticalSectionAndSpinCount RtlUnwind LoadLibraryA SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers GetCPInfo GetACP GetOEMCP IsValidCodePage GetConsoleOutputCP WriteConsoleW MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW CloseHandle CreateFileA

user32

GetCursorPos

gdi32

GetCharWidthFloatA

advapi32

DeregisterEventSource

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_968b847c6a2bbcb336a8c534b5d1a43a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

kernel32

user32

gdi32

advapi32

generic