2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop

General

Target
2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop
Size 1.3MB
Sample261017-e48r6ahv7j
SHA256 4f529cf663900e15d2cd4afd5fb946e1f11379cc9927ae53347b1a5ab70f6239
MD5 e43c287c30de6e1786311d447f2d7f6e
SHA1 c40fefeb43b9921d4717f836f7d8d6f68a19001c
SHA512 6c818d442046331c9f629f9aa4eb7b3666241769433ed8f8a5663206adff82f96f20e3b68d9ea0cdc158a3ea6790f7b4568ae52e8cf8193e68c78cc147d43ad1
SSDEEP 12288:WGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:2nQ/tbw/2Mkjy6Fr7g0oC
TLSH
T16B5523A87C88F877DD0B61F19845E1A0333B08605B92869377CB229DCF7939E455B2E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop

File Explorer

2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop

.exe 1.3MB

2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop

IMPHASH 336bd245d7f310958f66a82b2caa29f8
SHA256 4f529cf663900e15d2cd4afd5fb946e1f11379cc9927ae53347b1a5ab70f6239
MD5 e43c287c30de6e1786311d447f2d7f6e
SHA1 c40fefeb43b9921d4717f836f7d8d6f68a19001c
SHA512 6c818d442046331c9f629f9aa4eb7b3666241769433ed8f8a5663206adff82f96f20e3b68d9ea0cdc158a3ea6790f7b4568ae52e8cf8193e68c78cc147d43ad1
SSDEEP 12288:WGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:2nQ/tbw/2Mkjy6Fr7g0oC
TLSH
T16B5523A87C88F877DD0B61F19845E1A0333B08605B92869377CB229DCF7939E455B2E7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

8865

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

newdev

UpdateDriverForPlugAndPlayDevicesA

setupapi

SetupDiGetClassDevsA SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyA SetupDiSetDeviceRegistryPropertyA SetupDiCallClassInstaller SetupDiDestroyDeviceInfoList SetupCopyOEMInfA

kernel32

SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA CloseHandle GetLastError GetSystemInfo GetProcAddress CreateFileA GetVersionExA FreeLibrary LoadLibraryA SetLastError lstrlenA LocalAlloc LocalFree GetModuleFileNameA GetModuleHandleA Sleep GetCommandLineA GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent LCMapStringA WideCharToMultiByte MultiByteToWideChar LCMapStringW EnterCriticalSection LeaveCriticalSection ExitProcess WriteFile GetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection HeapCreate VirtualFree HeapFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetStringTypeA GetStringTypeW GetLocaleInfoA HeapAlloc RtlUnwind InitializeCriticalSectionAndSpinCount VirtualAlloc HeapReAlloc GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer HeapSize

advapi32

RegQueryValueExA RegCloseKey RegOpenKeyExA

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop

newdev

setupapi

kernel32

advapi32

generic