2026-10-01_bca2e522254dae0c736e1dd5fdb1b139_elex_redline-stealer_rhadamanthys_stop

General

Target
2026-10-01_bca2e522254dae0c736e1dd5fdb1b139_elex_redline-stealer_rhadamanthys_stop
Size 1.4MB
Sample261002-eyrlpat17r
SHA256 356f696937876bf86df015d592da44726f20ca6740cd61ef2c3c32b0575823b6
MD5 bca2e522254dae0c736e1dd5fdb1b139
SHA1 10dbfd70e01c65d1268accf0f5bb604ed292d56e
SHA512 246d2e5607af2cccb36c15918525e43ced01d59fac44c045a3d415d18effa387c25f67a7b779c7ebfb10721875f0b9d7dde9e6be1cc5f87df946ed7286a97d3a
SSDEEP 24576:nBkLPZ4MwVAnkdcvujbxAvgyqR9uCC6jfFIjQ0otXR:nCjwVAnMxdASuTuGjQ0oh
TLSH
T1E56523193706C972E8855035742CC7B08F173D6A2B758ADBB3412FEBBE24BD0EB5A119
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_bca2e522254dae0c736e1dd5fdb1b139_elex_redline-stealer_rhadamanthys_stop

File Explorer

2026-10-01_bca2e522254dae0c736e1dd5fdb1b139_elex_redline-stealer_rhadamanthys_stop

.exe 1.4MB

2026-10-01_bca2e522254dae0c736e1dd5fdb1b139_elex_redline-stealer_rhadamanthys_stop

IMPHASH ba2c974ed567c90fe365844af978f320
SHA256 356f696937876bf86df015d592da44726f20ca6740cd61ef2c3c32b0575823b6
MD5 bca2e522254dae0c736e1dd5fdb1b139
SHA1 10dbfd70e01c65d1268accf0f5bb604ed292d56e
SHA512 246d2e5607af2cccb36c15918525e43ced01d59fac44c045a3d415d18effa387c25f67a7b779c7ebfb10721875f0b9d7dde9e6be1cc5f87df946ed7286a97d3a
SSDEEP 24576:nBkLPZ4MwVAnkdcvujbxAvgyqR9uCC6jfFIjQ0otXR:nCjwVAnMxdASuTuGjQ0oh
TLSH
T1E56523193706C972E8855035742CC7B08F173D6A2B758ADBB3412FEBBE24BD0EB5A119
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

9747

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GenerateConsoleCtrlEvent GetExitCodeProcess WaitForSingleObject CreateProcessA SetConsoleCtrlHandler GetModuleFileNameA EnterCriticalSection LeaveCriticalSection GetModuleHandleW Sleep GetProcAddress ExitProcess GetCommandLineA GetStartupInfoA SetHandleCount GetStdHandle GetFileType DeleteCriticalSection TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetLastError HeapFree HeapAlloc GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId WriteFile LoadLibraryA InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind HeapReAlloc VirtualAlloc GetConsoleCP GetConsoleMode FlushFileBuffers LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetFilePointer HeapSize CloseHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA CompareStringA CompareStringW SetEnvironmentVariableA ReadFile SetEndOfFile GetProcessHeap GetFileAttributesA

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_bca2e522254dae0c736e1dd5fdb1b139_elex_redline-stealer_rhadamanthys_stop

kernel32

generic