2026-10-19_1777f011e15b379c39b109c7c6e16a6f_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

General

Target
2026-10-19_1777f011e15b379c39b109c7c6e16a6f_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
Size 2.2MB
Sample261021-dfb8lsyshy
SHA256 ab11a4397411b8b3745bc846e444e1267177d3829fdea12941f248fb20591d4e
MD5 1777f011e15b379c39b109c7c6e16a6f
SHA1 3a250938de4a9acb09a1e08ea6b8802b38c3aa75
SHA512 2b3231f0724865d1896390ed7f14e3dfbee1a6f3c0fb43a46d8faa85048dbf0b6836dad2c2c3a9377682f217ec7f17af83530c8e93dd18545e2ac7a7cac3d6cb
SSDEEP 24576:Pe6u/p6D3RSiYyyMRfHfMT99L5xyNq549uBeWXJjDXjMjGJoNehx4pL9:POB6zY2UJNzn5496NXJHuohqJ9
TLSH
T1E9B52320B7828073C26725B44AE5F7B85779BDA22BF299CF17C556F80F242C1927731A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-19_1777f011e15b379c39b109c7c6e16a6f_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

File Explorer

2026-10-19_1777f011e15b379c39b109c7c6e16a6f_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

.exe 2.2MB

2026-10-19_1777f011e15b379c39b109c7c6e16a6f_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

IMPHASH 28fddcffc23c8d6bd8c14acfa01b5fae
SHA256 ab11a4397411b8b3745bc846e444e1267177d3829fdea12941f248fb20591d4e
MD5 1777f011e15b379c39b109c7c6e16a6f
SHA1 3a250938de4a9acb09a1e08ea6b8802b38c3aa75
SHA512 2b3231f0724865d1896390ed7f14e3dfbee1a6f3c0fb43a46d8faa85048dbf0b6836dad2c2c3a9377682f217ec7f17af83530c8e93dd18545e2ac7a7cac3d6cb
SSDEEP 24576:Pe6u/p6D3RSiYyyMRfHfMT99L5xyNq549uBeWXJjDXjMjGJoNehx4pL9:POB6zY2UJNzn5496NXJHuohqJ9
TLSH
T1E9B52320B7828073C26725B44AE5F7B85779BDA22BF299CF17C556F80F242C1927731A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

35307

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

EndPaint DestroyWindow GetMessageA RegisterClassExA PostQuitMessage LoadStringA LoadIconA BeginPaint TranslateMessage TranslateAcceleratorA EndDialog DefWindowProcA LoadAcceleratorsA DispatchMessageA LoadCursorA DialogBoxParamA

kernel32

TlsGetValue SetStdHandle WriteConsoleW CloseHandle SetFilePointer ReadFile FlushFileBuffers GetConsoleMode GetConsoleCP InitializeCriticalSection IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetStringTypeW MultiByteToWideChar GetCommandLineA HeapSetInformation GetStartupInfoW DecodePointer EncodePointer TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc GetLastError HeapFree IsProcessorFeaturePresent RaiseException GetProcAddress GetModuleHandleW ExitProcess WriteFile GetStdHandle GetModuleFileNameW GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection TlsAlloc CreateFileW TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCurrentThread HeapCreate HeapDestroy QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetConsoleCtrlHandler GetLocaleInfoW LeaveCriticalSection FatalAppExitA EnterCriticalSection RtlUnwind Sleep HeapSize FreeLibrary InterlockedExchange LoadLibraryW GetCPInfo GetACP GetOEMCP IsValidCodePage HeapReAlloc LCMapStringW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-19_1777f011e15b379c39b109c7c6e16a6f_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

user32

kernel32

generic