2026-10-17_a3eab1c028247eb1f927f6376b4eeab8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

General

Target
2026-10-17_a3eab1c028247eb1f927f6376b4eeab8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
Size 623KB
Sample261018-2eybfswtbz
SHA256 24aae097a3323b172435af7e4e84d855334ef275d350afe0e740bcd556fba0a1
MD5 a3eab1c028247eb1f927f6376b4eeab8
SHA1 14e3c46ea77e1cea3bc44e513ee690b6782bd639
SHA512 0674b5632a778761ce24a32ab2b53df0bb0fd245a73e188d628a52b140a54ffda1ab6ba52ede9dfb0313918c1f5bf5e36010766d26a4bcba02ad64d1330d2729
SSDEEP 12288:W3SwGEpzLJMUJMtqSnhgMUmkoZ6Tim60ZW4hBi4hUz812CSj1+0r:W5GElLzBJzo+im/1hgCUz84CSht
TLSH
T18ED4121675E48074F5F31A75D8F2E6B14A7ABC600970E68B3B8E5A1D1F30A42DB3931B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-17_a3eab1c028247eb1f927f6376b4eeab8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

File Explorer

2026-10-17_a3eab1c028247eb1f927f6376b4eeab8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

.exe 623KB

2026-10-17_a3eab1c028247eb1f927f6376b4eeab8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

IMPHASH 157133ef39a9d0b6e186146f9ca57040
SHA256 24aae097a3323b172435af7e4e84d855334ef275d350afe0e740bcd556fba0a1
MD5 a3eab1c028247eb1f927f6376b4eeab8
SHA1 14e3c46ea77e1cea3bc44e513ee690b6782bd639
SHA512 0674b5632a778761ce24a32ab2b53df0bb0fd245a73e188d628a52b140a54ffda1ab6ba52ede9dfb0313918c1f5bf5e36010766d26a4bcba02ad64d1330d2729
SSDEEP 12288:W3SwGEpzLJMUJMtqSnhgMUmkoZ6Tim60ZW4hBi4hUz812CSj1+0r:W5GElLzBJzo+im/1hgCUz84CSht
TLSH
T18ED4121675E48074F5F31A75D8F2E6B14A7ABC600970E68B3B8E5A1D1F30A42DB3931B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

18297

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

mi_exe_stub.pdb

kernel32

GetCommandLineA GetStartupInfoA SetUnhandledExceptionFilter GetModuleHandleW Sleep GetProcAddress ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetLastError GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapCreate HeapDestroy VirtualFree HeapFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent LoadLibraryA InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage HeapAlloc VirtualAlloc HeapReAlloc RtlUnwind HeapSize GetLocaleInfoA LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetProcessHeap InitializeCriticalSection GetTempFileNameW FindResourceExW FindResourceW LoadResource SetFilePointerEx CreateDirectoryW SizeofResource FormatMessageW GetVersionExW GetModuleFileNameW CreateFileW lstrlenW GetTempPathW RaiseException LockResource RemoveDirectoryW CloseHandle DeleteFileW LocalFree CreateProcessW WaitForSingleObject GetExitCodeProcess GetStartupInfoW MapViewOfFile UnmapViewOfFile VirtualQuery CreateFileMappingW SetFilePointer ReadFile

shlwapi

PathQuoteSpacesW

ole32

CoUninitialize CoInitializeEx

user32

wvsprintfW CharLowerBuffW MessageBoxW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-17_a3eab1c028247eb1f927f6376b4eeab8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

kernel32

shlwapi

ole32

user32

generic