2026-10-01_5e10666a86465d92e4cd9e8fa000dbe8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

General

Target
2026-10-01_5e10666a86465d92e4cd9e8fa000dbe8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
Size 1.1MB
Sample261002-q2l16abd44
SHA256 f98061adbaba1ddb20f79382dc866716179f1dced2e8d261d8574f57167aea78
MD5 5e10666a86465d92e4cd9e8fa000dbe8
SHA1 e63e76266fac91995ff5666bb418eb665b1287cb
SHA512 30da35eb2836207ba5b0c468281f3ae8d06d042ac9136312c3ed5e8c496a508f7b74c4aca4a4c5f6041da0dbee1dcfeeecc9269fc0be2a471209ba3815f34350
SSDEEP 24576:9gRAmDgkhU0TE6s6o7GcQkSCDBsbAnx6fk4:89jxvsAkHdsbAnxmk
TLSH
T1BD3523117092F576E32B29748830D9F4BA7EBCB8537460BB7BA8271D6DB07C10A53B52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_5e10666a86465d92e4cd9e8fa000dbe8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

File Explorer

2026-10-01_5e10666a86465d92e4cd9e8fa000dbe8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

.exe 1.1MB

2026-10-01_5e10666a86465d92e4cd9e8fa000dbe8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

IMPHASH d8a0900ed2d0a41b2f243114447668ae
SHA256 f98061adbaba1ddb20f79382dc866716179f1dced2e8d261d8574f57167aea78
MD5 5e10666a86465d92e4cd9e8fa000dbe8
SHA1 e63e76266fac91995ff5666bb418eb665b1287cb
SHA512 30da35eb2836207ba5b0c468281f3ae8d06d042ac9136312c3ed5e8c496a508f7b74c4aca4a4c5f6041da0dbee1dcfeeecc9269fc0be2a471209ba3815f34350
SSDEEP 24576:9gRAmDgkhU0TE6s6o7GcQkSCDBsbAnx6fk4:89jxvsAkHdsbAnxmk
TLSH
T1BD3523117092F576E32B29748830D9F4BA7EBCB8537460BB7BA8271D6DB07C10A53B52
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

8426

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\poto daxoyewowiso\ril99\fudubezibuteco\petuporu.pdb

kernel32

HeapReAlloc FindVolumeClose FindFirstChangeNotificationW FindResourceExW HeapAlloc EndUpdateResourceW SetEnvironmentVariableW GetEnvironmentStringsW SetEvent FlushConsoleInputBuffer SleepEx GetTickCount FindActCtxSectionStringA TlsSetValue GlobalAlloc LoadLibraryW InitAtomTable FindNextVolumeW GetTapePosition WriteConsoleW GetMailslotInfo CreateActCtxA BindIoCompletionCallback GetProcAddress VirtualAlloc BeginUpdateResourceW GetAtomNameA LoadLibraryA WriteConsoleA GetModuleFileNameA GetProcessAffinityMask AddConsoleAliasA lstrcpyA CreateFileW HeapSize DecodePointer EncodePointer GetCommandLineA HeapSetInformation GetStartupInfoW IsProcessorFeaturePresent GetLastError WideCharToMultiByte SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection EnterCriticalSection LeaveCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess RtlUnwind SetFilePointer TlsAlloc TlsGetValue TlsFree InterlockedIncrement GetModuleHandleW SetLastError GetCurrentThreadId InterlockedDecrement HeapFree CloseHandle ExitProcess WriteFile GetModuleFileNameW FreeEnvironmentStringsW HeapCreate QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage Sleep CreateFileA SetStdHandle FlushFileBuffers RaiseException MultiByteToWideChar LCMapStringW GetStringTypeW SetEndOfFile GetProcessHeap ReadFile

user32

SetCursorPos

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_5e10666a86465d92e4cd9e8fa000dbe8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

kernel32

user32

generic