2026-10-20_7e1e9279e3b228be319e553c213e6769_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

General

Target
2026-10-20_7e1e9279e3b228be319e553c213e6769_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
Size 1.7MB
Sample261020-gvb3yahz5j
SHA256 e257369b6a49e4b50fd0275e61d1b59fd9ffebc3fb212ed4cd0c61cc1e8930c1
MD5 7e1e9279e3b228be319e553c213e6769
SHA1 7c01ed7b1937e39499d30ba5f9a859d136d36cbe
SHA512 21ccca67b0bf8436777238332166af7d05aaab6fbdd8fcb0cc7396145d5700d991f06a285058066b1f5dc5b1222d0cf666ff54873d3ab2000abbfaa590549d7a
SSDEEP 24576:ngrj8B6enUoI+zS59X7fIZ9T/Z7xx0PTBcVJ7jHBHYC5bVF22kwa0ppKZIsnPayj:Mj66eve558Z9Tpa965jHBHYypxwOUz7n
TLSH
T1F985335B56804C76ED8AA1B3444DD215E31FB60203D19D8A6EC52DF23FE38C22E7A67D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-20_7e1e9279e3b228be319e553c213e6769_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

File Explorer

2026-10-20_7e1e9279e3b228be319e553c213e6769_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

.exe 1.7MB

2026-10-20_7e1e9279e3b228be319e553c213e6769_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

IMPHASH 74163037421806f0cf9c27e968112bc2
SHA256 e257369b6a49e4b50fd0275e61d1b59fd9ffebc3fb212ed4cd0c61cc1e8930c1
MD5 7e1e9279e3b228be319e553c213e6769
SHA1 7c01ed7b1937e39499d30ba5f9a859d136d36cbe
SHA512 21ccca67b0bf8436777238332166af7d05aaab6fbdd8fcb0cc7396145d5700d991f06a285058066b1f5dc5b1222d0cf666ff54873d3ab2000abbfaa590549d7a
SSDEEP 24576:ngrj8B6enUoI+zS59X7fIZ9T/Z7xx0PTBcVJ7jHBHYC5bVF22kwa0ppKZIsnPayj:Mj66eve558Z9Tpa965jHBHYypxwOUz7n
TLSH
T1F985335B56804C76ED8AA1B3444DD215E31FB60203D19D8A6EC52DF23FE38C22E7A67D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

13051

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentProcess GetVersionExA OpenFile FreeLibrary GetProcAddress LoadLibraryA _lcreat _lclose _lopen GetModuleFileNameA GetModuleHandleA GetCommandLineA SetErrorMode WinExec LCMapStringW LCMapStringA GetStringTypeW MultiByteToWideChar GetStringTypeA GetLocaleInfoA RtlUnwind HeapReAlloc VirtualAlloc HeapAlloc InitializeCriticalSectionAndSpinCount ExitProcess _lwrite GetLastError lstrcatA FormatMessageA LocalFree lstrcpyA GetTempPathA GetWindowsDirectoryA GetTempFileNameA MulDiv lstrlenA _lread _llseek GlobalLock GlobalUnlock GlobalFree GlobalAlloc HeapSize GetStartupInfoA GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent Sleep WriteFile GetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection HeapCreate VirtualFree HeapFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage

user32

wsprintfA ExitWindowsEx CreateWindowExA ShowWindow SetWindowPos UpdateWindow SetTimer LoadIconA LoadCursorA RegisterClassA MessageBoxA DefWindowProcA BeginPaint DrawTextA EndPaint InvalidateRect PostQuitMessage SendMessageA GetDC ReleaseDC GetClientRect

gdi32

GetStockObject CreatePalette SelectPalette RealizePalette GetDeviceCaps CreateFontA StretchDIBits SelectObject SetBkMode SetTextColor TextOutA DeleteObject CreateSolidBrush PatBlt

advapi32

OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-20_7e1e9279e3b228be319e553c213e6769_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

kernel32

user32

gdi32

advapi32

generic