2026-10-22_ba97f266b56fb78502bbf8fd6327c485_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

General

Target
2026-10-22_ba97f266b56fb78502bbf8fd6327c485_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
Size 376KB
Sample261023-2vb36aet8w
SHA256 85444a4ebedd75ad4b52a15bb3975209f451d43ae632dd3981c7b52d5e11b48f
MD5 ba97f266b56fb78502bbf8fd6327c485
SHA1 3a68e0a8c3e26fb97e6f444fe9381c3b7a939b2f
SHA512 aba68dc84ec4c7abcd7a88f3380aea0f741f64872f181b3a13efc16da42df2ede65b416148f30aac7f32e9d4efcc863b34dbcca69492d387a3446b9d8b0b827b
SSDEEP 3072:YL7q8fUjVkmmdzj7Mz6sa2p7Tn7CF+6aLK2IJqi6uS+gkDstXKJVP88JTDr:UfURk+pQJV
TLSH
T1C884F802B216E9F0D459857A1517A2F61BCA2D311E0FAC33B349BF2739711E16A25B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_ba97f266b56fb78502bbf8fd6327c485_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

File Explorer

2026-10-22_ba97f266b56fb78502bbf8fd6327c485_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

.exe 376KB

2026-10-22_ba97f266b56fb78502bbf8fd6327c485_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

IMPHASH a5022d570c8b3be0ba1a259795dce999
SHA256 85444a4ebedd75ad4b52a15bb3975209f451d43ae632dd3981c7b52d5e11b48f
MD5 ba97f266b56fb78502bbf8fd6327c485
SHA1 3a68e0a8c3e26fb97e6f444fe9381c3b7a939b2f
SHA512 aba68dc84ec4c7abcd7a88f3380aea0f741f64872f181b3a13efc16da42df2ede65b416148f30aac7f32e9d4efcc863b34dbcca69492d387a3446b9d8b0b827b
SSDEEP 3072:YL7q8fUjVkmmdzj7Mz6sa2p7Tn7CF+6aLK2IJqi6uS+gkDstXKJVP88JTDr:UfURk+pQJV
TLSH
T1C884F802B216E9F0D459857A1517A2F61BCA2D311E0FAC33B349BF2739711E16A25B3F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

237568

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarSub _CIcos _adj_fptan __vbaStrI4 __vbaVarMove __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaLenBstr __vbaStrVarMove __vbaPut3 __vbaFreeVarList __vbaEnd _adj_fdiv_m64 __vbaAryRecMove ord621 __vbaFreeObjList _adj_fprem1 __vbaRecAnsiToUni __vbaResume __vbaStrCat __vbaError __vbaLsetFixstr __vbaBoolErrVar __vbaRecDestruct __vbaSetSystemError __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 __vbaAryDestruct ord593 __vbaVarForInit __vbaExitProc ord594 ord595 __vbaObjSet __vbaOnError _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i ord598 ord599 __vbaStrFixstr __vbaBoolVarNull __vbaVarTstLt _CIsin ord709 __vbaVargVarMove ord632 __vbaChkstk __vbaFileClose EVENT_SINK_AddRef ord528 __vbaGenerateBoundsError __vbaStrCmp ord529 __vbaAryConstruct2 __vbaPutOwner3 __vbaVarTstEq __vbaCyI4 DllFunctionCall __vbaVarOr __vbaFpUI1 __vbaLbound __vbaRedimPreserve _adj_fpatan __vbaRedim __vbaStrR8 __vbaRecUniToAnsi EVENT_SINK_Release ord600 __vbaUI1I2 _CIsqrt __vbaVarAnd EVENT_SINK_QueryInterface __vbaUI1I4 __vbaFpCmpCy __vbaExceptHandler __vbaStrToUnicode __vbaPrintFile _adj_fprem _adj_fdivr_m64 ord607 __vbaVarDiv ord608 ord531 __vbaFPException __vbaInStrVar ord717 ord532 __vbaUbound __vbaGetOwner3 __vbaStrVarVal __vbaVarCat __vbaI2Var ord537 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaVar2Vec __vbaInStr ord648 ord570 __vbaR8Str __vbaNew2 ord571 _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy __vbaI4Str __vbaFreeStrList ord576 _adj_fdivr_m32 _adj_fdiv_r ord578 ord685 ord100 __vbaVarTstNe ord579 __vbaI4Var __vbaVarCmpEq __vbaAryLock __vbaVarAdd __vbaStrComp __vbaStrToAnsi __vbaVarDup ord612 __vbaVarCopy __vbaFpI4 ord616 ord617 _CIatan ord618 __vbaStrMove __vbaCastObj ord619 ord543 _allmul __vbaAryRecCopy _CItan __vbaAryUnlock __vbaFPInt __vbaVarForNext _CIexp __vbaRecAssign __vbaFreeObj __vbaFreeStr ord580 ord581

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_ba97f266b56fb78502bbf8fd6327c485_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

msvbvm60

generic