2026-10-01_7ea09cf7fb62918df701efdd0e9f56f9_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

General

Target
2026-10-01_7ea09cf7fb62918df701efdd0e9f56f9_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
Size 138KB
Sample261002-mn4ghaxcrc
SHA256 83e6f9df188ec5ae966d68f9968f40a45f57491bf88f2f8473867ed129311aa3
MD5 7ea09cf7fb62918df701efdd0e9f56f9
SHA1 bc335026b3bc9aed0d183926dfd54404e1d420f0
SHA512 8e295055c9d72f67e06a79d854948a7a7ccd155ee32d549a833962b31e1274ae2927001fbc27ad36804a4c519bb404038097d64fbae1e4e004f979ca085170cc
SSDEEP 1536:mI2wVG40AQdPAEy2NsC0Ckvgwq24nTrCPSJWN260xXfk2dom0MaxRKD24e/6Y5Wx:ZncA2Py2xDmwpWg5xXT0FnKq/6aWx
TLSH
T100D39D2172EDC731E1E3253048BCFBB11AFEB8322974448B77A4267E5E706C09A69757
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_7ea09cf7fb62918df701efdd0e9f56f9_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

File Explorer

2026-10-01_7ea09cf7fb62918df701efdd0e9f56f9_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

.exe 138KB

2026-10-01_7ea09cf7fb62918df701efdd0e9f56f9_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

IMPHASH 7220f2b8f04ec1b97c7c8d98e0adef7a
SHA256 83e6f9df188ec5ae966d68f9968f40a45f57491bf88f2f8473867ed129311aa3
MD5 7ea09cf7fb62918df701efdd0e9f56f9
SHA1 bc335026b3bc9aed0d183926dfd54404e1d420f0
SHA512 8e295055c9d72f67e06a79d854948a7a7ccd155ee32d549a833962b31e1274ae2927001fbc27ad36804a4c519bb404038097d64fbae1e4e004f979ca085170cc
SSDEEP 1536:mI2wVG40AQdPAEy2NsC0Ckvgwq24nTrCPSJWN260xXfk2dom0MaxRKD24e/6Y5Wx:ZncA2Py2xDmwpWg5xXT0FnKq/6aWx
TLSH
T100D39D2172EDC731E1E3253048BCFBB11AFEB8322974448B77A4267E5E706C09A69757
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

8223

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\nago7\jecodo-vupigojezoce_b.pdb

kernel32

LoadResource HeapAlloc GetConsoleAliasA GetEnvironmentStringsW AddConsoleAliasW FlushConsoleInputBuffer GetTickCount SetConsoleCursorPosition WriteConsoleW SetLastError GetProcAddress VirtualAlloc BeginUpdateResourceW GetFirmwareEnvironmentVariableW GetAtomNameA LoadLibraryA LocalAlloc GetModuleFileNameA EraseTape FindNextVolumeA lstrcpyW LCMapStringA SetProcessAffinityMask CreateFileW ReadFile EncodePointer DecodePointer GetModuleHandleW ExitProcess GetCommandLineA HeapSetInformation GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection WriteFile GetModuleFileNameW HeapCreate TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId GetLastError InterlockedDecrement RtlUnwind SetFilePointer HeapFree CloseHandle LoadLibraryW FreeEnvironmentStringsW WideCharToMultiByte QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime Sleep GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage CreateFileA SetStdHandle FlushFileBuffers HeapSize RaiseException HeapReAlloc MultiByteToWideChar LCMapStringW GetStringTypeW SetEndOfFile GetProcessHeap

user32

SetCursorPos

gdi32

GetCharWidth32A

advapi32

CloseEventLog

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_7ea09cf7fb62918df701efdd0e9f56f9_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

kernel32

user32

gdi32

advapi32

generic