2026-10-13_df60138b1fd5c404a261ef408b607b7a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-13_df60138b1fd5c404a261ef408b607b7a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 5.4MB
Sample261014-eexnlavx7p
SHA256 d0020deda3006f0b44c8905fc9dee3d5442b05031dbca72e8af6f7fbc3ca92a1
MD5 df60138b1fd5c404a261ef408b607b7a
SHA1 8eaf7966abcb73aacf56d048ae02471a6aa6bea1
SHA512 3eac024ea2ed6dc8763c2ea99b2130d0b50f0e5ab03a6b3447aa5a3d0eb2295d4a32acf6ed7278d021ae6c4177e5d0ddcc4e3caf875b3f7e9a2789a3a0af8d6d
SSDEEP 98304:SmYAlhwg3S5bJqsEy6JvFvWZr4fpNfcrob+jH+PS0J/m7Zs9i3iJwUFeoCIRYaqG:QAh7S51qLLtWexyrobC+PTmZ8jegYW
TLSH
T135463312E751CD33E5E2047CA8A0D3B1BA783572572B8053BB9D1B2D3A722E1A67D707
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-13_df60138b1fd5c404a261ef408b607b7a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-10-13_df60138b1fd5c404a261ef408b607b7a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 5.4MB

2026-10-13_df60138b1fd5c404a261ef408b607b7a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH f248ec36f6cec966c3b020d2fcb9224b
SHA256 d0020deda3006f0b44c8905fc9dee3d5442b05031dbca72e8af6f7fbc3ca92a1
MD5 df60138b1fd5c404a261ef408b607b7a
SHA1 8eaf7966abcb73aacf56d048ae02471a6aa6bea1
SHA512 3eac024ea2ed6dc8763c2ea99b2130d0b50f0e5ab03a6b3447aa5a3d0eb2295d4a32acf6ed7278d021ae6c4177e5d0ddcc4e3caf875b3f7e9a2789a3a0af8d6d
SSDEEP 98304:SmYAlhwg3S5bJqsEy6JvFvWZr4fpNfcrob+jH+PS0J/m7Zs9i3iJwUFeoCIRYaqG:QAh7S51qLLtWexyrobC+PTmZ8jegYW
TLSH
T135463312E751CD33E5E2047CA8A0D3B1BA783572572B8053BB9D1B2D3A722E1A67D707
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

212992

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\dd\NetFXDev1\binaries\x86ret\bin\i386\VSSetup\Utils\boxstub.pdb

advapi32

CreateWellKnownSid InitializeSecurityDescriptor SetEntriesInAclW SetSecurityDescriptorDacl SetSecurityDescriptorOwner CryptAcquireContextW CryptGenRandom CryptReleaseContext DecryptFileW

kernel32

CreateProcessW Sleep WaitForSingleObject GetExitCodeProcess CloseHandle SetFileAttributesW InitializeCriticalSection CreateEventW CreateThread DeleteCriticalSection EnterCriticalSection ExpandEnvironmentStringsW SetEvent GetCommandLineW lstrlenW CompareStringW LocalFree CreateDirectoryW QueryDosDeviceW GetLogicalDriveStringsW GetDiskFreeSpaceExW GetDriveTypeW CreateFileW DeviceIoControl SetErrorMode RemoveDirectoryW MoveFileExW LoadLibraryW GetProcAddress GetSystemDirectoryW GetLastError SetEnvironmentVariableW ExitThread GetTickCount GetEnvironmentVariableW GetModuleHandleW LeaveCriticalSection WaitForMultipleObjects ResetEvent CreateEventA GetSystemInfo FileTimeToSystemTime FileTimeToLocalFileTime FileTimeToDosDateTime GetModuleHandleA GetVersionExA SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime SetEndOfFile DuplicateHandle ReadFile GetCommandLineA HeapSetInformation GetStartupInfoW SetUnhandledExceptionFilter ExitProcess WriteFile GetStdHandle GetModuleFileNameW GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapCreate QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent HeapFree GetCPInfo GetACP GetOEMCP IsValidCodePage HeapAlloc LCMapStringW RtlUnwind SetFilePointer GetConsoleCP GetConsoleMode MultiByteToWideChar GetStringTypeW HeapSize HeapReAlloc IsProcessorFeaturePresent SetStdHandle WriteConsoleW FlushFileBuffers CreateFileA GetLocalTime GetComputerNameW lstrlenA FormatMessageW GetSystemTime GetTimeZoneInformation SystemTimeToTzSpecificLocalTime DeleteFileW GetFileAttributesW FindFirstFileW FindNextFileW FindClose GetCurrentDirectoryW SetCurrentDirectoryW GetProcessHeap GlobalAlloc GlobalFree SetFilePointerEx RaiseException

comctl32

ord17

rpcrt4

UuidCreate UuidToStringW RpcStringFreeW

shell32

SHBrowseForFolderW SHGetPathFromIDListW CommandLineToArgvW

shlwapi

PathRemoveExtensionW

user32

GetTopWindow GetWindowThreadProcessId GetWindow SendMessageW MessageBoxW PostMessageW DialogBoxParamW GetDlgItem SetWindowTextW EndDialog PostQuitMessage SetWindowLongW GetWindowLongW LoadStringW CharUpperW

cabinet

ord22 ord23 ord20

oleaut32

VariantClear SysAllocString

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

Name

.text

Size

155KB

Virtual Size

154KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.boxld01

Size

512B

Virtual Size

214B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

rxjmnk

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

144KB

Virtual Size

144KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-13_df60138b1fd5c404a261ef408b607b7a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

advapi32

kernel32

comctl32

rpcrt4

shell32

shlwapi

user32

cabinet

oleaut32

version

generic