2026-10-01_6b6ab6e3c8ff01d1472f3afd414d5292_elex_redline-stealer_rhadamanthys_stop

General

Target
2026-10-01_6b6ab6e3c8ff01d1472f3afd414d5292_elex_redline-stealer_rhadamanthys_stop
Size 2.2MB
Sample261002-p1s8eavy3r
SHA256 b08b51cb8f17b6f06d32c2e672e962175608c7fceeb0dd607fcbf57940792045
MD5 6b6ab6e3c8ff01d1472f3afd414d5292
SHA1 4b146d4ed9786776c490b984a167d370cf46c0af
SHA512 4db93006ea2cde7f4155e086af90b8f20c0eb3a2f792596fea2a30df27cf9c9bfabee87308b84f3705668d70326e7dc8256f4ca10d203040e2ffc7f5872b218f
SSDEEP 24576:6zkLPZ4MwVAnkdjM/H9cgEX/QcuFK9vdqrifgGPpoo:6YjwVAnMjMMXoKvkri4GPao
TLSH
T128A533083382C433EC1760FB646DD2F4162B24D641AED7477265AF7A9F397C1AB2E261
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_6b6ab6e3c8ff01d1472f3afd414d5292_elex_redline-stealer_rhadamanthys_stop

File Explorer

2026-10-01_6b6ab6e3c8ff01d1472f3afd414d5292_elex_redline-stealer_rhadamanthys_stop

.exe 2.2MB

2026-10-01_6b6ab6e3c8ff01d1472f3afd414d5292_elex_redline-stealer_rhadamanthys_stop

IMPHASH ba2c974ed567c90fe365844af978f320
SHA256 b08b51cb8f17b6f06d32c2e672e962175608c7fceeb0dd607fcbf57940792045
MD5 6b6ab6e3c8ff01d1472f3afd414d5292
SHA1 4b146d4ed9786776c490b984a167d370cf46c0af
SHA512 4db93006ea2cde7f4155e086af90b8f20c0eb3a2f792596fea2a30df27cf9c9bfabee87308b84f3705668d70326e7dc8256f4ca10d203040e2ffc7f5872b218f
SSDEEP 24576:6zkLPZ4MwVAnkdjM/H9cgEX/QcuFK9vdqrifgGPpoo:6YjwVAnMjMMXoKvkri4GPao
TLSH
T128A533083382C433EC1760FB646DD2F4162B24D641AED7477265AF7A9F397C1AB2E261
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

9747

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GenerateConsoleCtrlEvent GetExitCodeProcess WaitForSingleObject CreateProcessA SetConsoleCtrlHandler GetModuleFileNameA EnterCriticalSection LeaveCriticalSection GetModuleHandleW Sleep GetProcAddress ExitProcess GetCommandLineA GetStartupInfoA SetHandleCount GetStdHandle GetFileType DeleteCriticalSection TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetLastError HeapFree HeapAlloc GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId WriteFile LoadLibraryA InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind HeapReAlloc VirtualAlloc GetConsoleCP GetConsoleMode FlushFileBuffers LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetFilePointer HeapSize CloseHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA CompareStringA CompareStringW SetEnvironmentVariableA ReadFile SetEndOfFile GetProcessHeap GetFileAttributesA

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_6b6ab6e3c8ff01d1472f3afd414d5292_elex_redline-stealer_rhadamanthys_stop

kernel32

generic