2026-10-11_6b381e44904d278744a9ed6787d90acc_elex_redline-stealer_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-11_6b381e44904d278744a9ed6787d90acc_elex_redline-stealer_rhadamanthys_stop
Size 585KB
Sample261012-x2fmpswt6q
SHA256 8ca68b106b6523d963c0ba7d8bb88f753ff90124a873a1db1f3a2ca35913ac0a
MD5 6b381e44904d278744a9ed6787d90acc
SHA1 ffa6f8dc21be8c8e161b0fe381b33149113e3e0d
SHA512 651471fa1ab5344dd5e3e695d4c821d151e930a01b53b37a03b4e5ad32fd76436fad751fc8c88bdb2dd7006539d29393da375544cb61cf4aa0cc9e35bc64d5f4
SSDEEP 12288:ckGCeJ+PGKJeTq6ZVOA8wih5MEs1aVRGuj/3SgEAgWC4:cksQPGKJeTq6OA8pQsY23Sv9D4
TLSH
T18AD40202B681D432E0E61E39A934D7F21A79BD301E75889B76C43A6FEF312C0D9157E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-11_6b381e44904d278744a9ed6787d90acc_elex_redline-stealer_rhadamanthys_stop

File Explorer

2026-10-11_6b381e44904d278744a9ed6787d90acc_elex_redline-stealer_rhadamanthys_stop

.exe 585KB

2026-10-11_6b381e44904d278744a9ed6787d90acc_elex_redline-stealer_rhadamanthys_stop

IMPHASH c2fdb3e361b8686e367e220950c935b9
SHA256 8ca68b106b6523d963c0ba7d8bb88f753ff90124a873a1db1f3a2ca35913ac0a
MD5 6b381e44904d278744a9ed6787d90acc
SHA1 ffa6f8dc21be8c8e161b0fe381b33149113e3e0d
SHA512 651471fa1ab5344dd5e3e695d4c821d151e930a01b53b37a03b4e5ad32fd76436fad751fc8c88bdb2dd7006539d29393da375544cb61cf4aa0cc9e35bc64d5f4
SSDEEP 12288:ckGCeJ+PGKJeTq6ZVOA8wih5MEs1aVRGuj/3SgEAgWC4:cksQPGKJeTq6OA8pQsY23Sv9D4
TLSH
T18AD40202B681D432E0E61E39A934D7F21A79BD301E75889B76C43A6FEF312C0D9157E6
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

26770

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

shell32

ShellExecuteW SHGetPathFromIDListA SHBrowseForFolderA SHGetMalloc FindExecutableW

user32

GetSysColor GetClientRect SetRect EndPaint LoadCursorA CharUpperBuffA GetLastActivePopup ShowWindow PostMessageA SendMessageA EnableWindow SetWindowTextA SetForegroundWindow SetActiveWindow GetKeyState MessageBoxW GetParent SetDlgItemTextA SendDlgItemMessageA GetDlgItem BeginPaint UpdateWindow LoadStringA MessageBoxA GetWindowLongA SetWindowLongA wsprintfA SetTimer KillTimer DialogBoxParamA GetDlgItemTextA EndDialog GetWindowRect GetSystemMetrics SetWindowPos PeekMessageA TranslateMessage DispatchMessageA SetCursor CharNextA SetWindowWord GetWindowWord DefWindowProcA RegisterClassA InvalidateRect

kernel32

GetConsoleMode GetConsoleCP SetFilePointer GetLocaleInfoA EnterCriticalSection LeaveCriticalSection GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter HeapFree VirtualFree HeapCreate DeleteCriticalSection GetFileType SetHandleCount GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStdHandle Sleep IsDebuggerPresent lstrcatA FindClose FindFirstFileA GetCurrentDirectoryA CreateDirectoryA SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime LocalAlloc GetDriveTypeA lstrcpyA _lclose GlobalLock GlobalAlloc lstrlenA GlobalFree GlobalUnlock GlobalHandle GetEnvironmentVariableA LocalFree _llseek _lread _lopen CloseHandle WriteFile CreateFileA ExitProcess GetModuleHandleA _lcreat GetVolumeInformationA MultiByteToWideChar CreateProcessW lstrlenW GetWindowsDirectoryA lstrcmpiA GlobalMemoryStatus GetVersion GetVersionExA GetModuleFileNameA GetSystemTime _lwrite SetErrorMode LoadLibraryA InitializeCriticalSectionAndSpinCount HeapAlloc VirtualAlloc HeapReAlloc SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW HeapSize FlushFileBuffers SetCurrentDirectoryA GetModuleFileNameW RtlUnwind GetCommandLineA GetStartupInfoA GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId GetLastError TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter

gdi32

SetTextColor SetTextAlign GetBkColor GetTextExtentPoint32A ExtTextOutA CreateDCA GetDeviceCaps CreateFontIndirectA DeleteDC SelectObject DeleteObject SetBkColor

advapi32

RegQueryValueW

comctl32

ord17

Name

.text

Size

59KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

_winzip_

Size

61.1MB

Virtual Size

61.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-11_6b381e44904d278744a9ed6787d90acc_elex_redline-stealer_rhadamanthys_stop

shell32

user32

kernel32

gdi32

advapi32

comctl32

generic