2026-10-14_c9a74fdd0ed22d63770dbb9ff21ae19a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

General

Target
2026-10-14_c9a74fdd0ed22d63770dbb9ff21ae19a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
Size 10.4MB
Sample261014-pcdsta1x5n
SHA256 33445d515b7c490094456913e6e6999af00e1128ff1e8e81528c2d65807c76a3
MD5 c9a74fdd0ed22d63770dbb9ff21ae19a
SHA1 7bd8d54ea0af45cfac5ff02f8db33831bc0d5dd6
SHA512 61dd202076f21882a0c393e03a2c6b3aa4e644df659d8ba1026d23de22df41a4b930c492e6e8168c50b91936e0ebc0b62c871160ae93a08dc68732e251a076aa
SSDEEP 3072:K05Xaz5ADFeLcYUL0raX1cmS7d/zCpmHbj9nGezTWJPUKX5hzT4SNN4SNN4SNN44:KEM6YUL02lcmErCYGezTYdD
TLSH
T108B65B2255B62570C87D417D3B0C774C2AEFF7F2A2E4A2BB9129A5C40813B8D55C6E3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-14_c9a74fdd0ed22d63770dbb9ff21ae19a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-10-14_c9a74fdd0ed22d63770dbb9ff21ae19a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

.exe 10.4MB

2026-10-14_c9a74fdd0ed22d63770dbb9ff21ae19a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

IMPHASH e33fc10ac8b1ad5a04646026b94890a5
SHA256 33445d515b7c490094456913e6e6999af00e1128ff1e8e81528c2d65807c76a3
MD5 c9a74fdd0ed22d63770dbb9ff21ae19a
SHA1 7bd8d54ea0af45cfac5ff02f8db33831bc0d5dd6
SHA512 61dd202076f21882a0c393e03a2c6b3aa4e644df659d8ba1026d23de22df41a4b930c492e6e8168c50b91936e0ebc0b62c871160ae93a08dc68732e251a076aa
SSDEEP 3072:K05Xaz5ADFeLcYUL0raX1cmS7d/zCpmHbj9nGezTWJPUKX5hzT4SNN4SNN4SNN44:KEM6YUL02lcmErCYGezTYdD
TLSH
T108B65B2255B62570C87D417D3B0C774C2AEFF7F2A2E4A2BB9129A5C40813B8D55C6E3B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

35689

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\gahor-45\yakol yabegav bazavebawetose\locuyuciw.pdb

kernel32

GetConsoleAliasExesLengthA GetCommState WaitNamedPipeA GetLogicalDriveStringsW GlobalSize CreateHardLinkA WaitForSingleObjectEx ReadConsoleW EnumResourceTypesA SetHandleCount LoadLibraryW GetConsoleMode InterlockedPopEntrySList lstrcpynW GetWriteWatch GetFileAttributesW WriteConsoleW GetModuleFileNameW GetCompressedFileSizeA CreateActCtxA WritePrivateProfileStringW GetConsoleAliasesW GetStdHandle SetLastError GetProcAddress VirtualAlloc BeginUpdateResourceW EnumSystemCodePagesW FindResourceExW SearchPathA LoadLibraryA LocalAlloc DnsHostnameToComputerNameA WriteProfileSectionW FoldStringA GetModuleHandleA GetCommTimeouts FreeEnvironmentStringsW GetConsoleTitleW GetShortPathNameW DeleteTimerQueueTimer GlobalAddAtomW DebugBreak ReadConsoleOutputCharacterW EnumCalendarInfoExA DeleteFileA FlushFileBuffers CloseHandle CreateFileA GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoW GetConsoleCP GetNumaProcessorNode IsBadStringPtrW FindVolumeClose CreateMemoryResourceNotification SetDefaultCommConfigA InterlockedIncrement InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter GetLastError HeapFree MultiByteToWideChar TerminateProcess GetCurrentProcess IsDebuggerPresent GetStartupInfoW RtlUnwind RaiseException LCMapStringA WideCharToMultiByte LCMapStringW GetCPInfo GetModuleHandleW ExitProcess WriteFile GetModuleFileNameA HeapAlloc HeapCreate VirtualFree HeapReAlloc GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId GetEnvironmentStringsW GetCommandLineW GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapSize GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW InitializeCriticalSectionAndSpinCount SetFilePointer

user32

ToAsciiEx LoadBitmapA LoadMenuA IsWindowEnabled MessageBoxIndirectA DrawEdge GetScrollInfo GetWindowLongW GetKeyNameTextW ModifyMenuA

gdi32

GetCharABCWidthsA CreateDiscardableBitmap GetCharWidthI

advapi32

GetEventLogInformation

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-14_c9a74fdd0ed22d63770dbb9ff21ae19a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

kernel32

user32

gdi32

advapi32

generic