2026-10-22_fd1c262a873ade5c0a346742fe8c1120_amadey_cloudeye_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_fd1c262a873ade5c0a346742fe8c1120_amadey_cloudeye_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
Size 88.6MB
Sample261023-aleddayw4m
SHA256 821576d61eee8f86ca30865f148c122f4a0249a0702e0f42ad33b379fd86c08d
MD5 fd1c262a873ade5c0a346742fe8c1120
SHA1 ce65a3157153a266e1416cb16ca657de5503d9d9
SHA512 a800c6e463baa3e8a99fa57fd0705c442a6e3b976b553937b7ac1ab2a889830f44eafc8029f396ba38b9b4a61444095a076abc1e06ed81f3a1e7cdd16db4b484
SSDEEP 1572864:XO/lpK/3PKmFqGVlkziGOLgG2y3oJV00Eh7T2YXq+vCqwdU6jJsVtTbusgX:XO/6/fKutVoTOF29NEh7T2Ya4lIjJwBK
TLSH
T1D31833AAD251C4F4DCBA07B884E9466B13F1FC286301A4D777766FBE47A92C149F2306
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-10-22_fd1c262a873ade5c0a346742fe8c1120_amadey_cloudeye_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-10-22_fd1c262a873ade5c0a346742fe8c1120_amadey_cloudeye_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

.exe 88.6MB

2026-10-22_fd1c262a873ade5c0a346742fe8c1120_amadey_cloudeye_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 1ff847646487d56f85778df99ff3728a
SHA256 821576d61eee8f86ca30865f148c122f4a0249a0702e0f42ad33b379fd86c08d
MD5 fd1c262a873ade5c0a346742fe8c1120
SHA1 ce65a3157153a266e1416cb16ca657de5503d9d9
SHA512 a800c6e463baa3e8a99fa57fd0705c442a6e3b976b553937b7ac1ab2a889830f44eafc8029f396ba38b9b4a61444095a076abc1e06ed81f3a1e7cdd16db4b484
SSDEEP 1572864:XO/lpK/3PKmFqGVlkziGOLgG2y3oJV00Eh7T2YXq+vCqwdU6jJsVtTbusgX:XO/6/fKutVoTOF29NEh7T2Ya4lIjJwBK
TLSH
T1D31833AAD251C4F4DCBA07B884E9466B13F1FC286301A4D777766FBE47A92C149F2306
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX dump on OEP (original entry point)
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

06:f1:c6:a2:03:cb:cb:94:8b:95:41:c6:27:63:2d:a0:c6:7d:89:80:6d:88:d7:7f:f7:1d:d4:d8:af:3c:e6:32

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=亚洲诚信代码签名测试证书SHA2,O=亚数信息科技（上海）有限公司,L=上海市,ST=上海市,C=CN

Chains

Oct 22, 2026

CN=亚洲诚信代码签名测试证书SHA2,O=亚数信息科技（上海）有限公司,L=上海市,ST=上海市,C=CN

CN=TrustAsia SHA2 Code Signing CA,O=TrustAsia Technologies\, Inc.,C=CN

PE Signature issue

Digest

5b:63:78:bd:3f:3f:5b:85:66:4c:ce:c7:74:55:c1:1b:c6:ed:e3:64

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=亚洲诚信代码签名测试证书,O=亚数信息科技（上海）有限公司,L=上海市,ST=上海市,C=CN

Chains

Oct 22, 2026

CN=亚洲诚信代码签名测试证书,O=亚数信息科技（上海）有限公司,L=上海市,ST=上海市,C=CN

Subject

CN=亚洲诚信代码签名测试证书,O=亚数信息科技（上海）有限公司,L=上海市,ST=上海市,C=CN

Serial Number

Issuer

CN=TrustAsia Code Signing CA,O=TrustAsia Technologies\, Inc.,C=CN

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 29, 2018 - Jan 29, 2020

Subject

CN=TrustAsia Code Signing CA,O=TrustAsia Technologies\, Inc.,C=CN

Serial Number

Issuer

CN=TrustAsia Root CA,O=TrustAsia Technologies\, Inc.,C=CN

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

May 19, 2010 - May 19, 2020

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=亚洲诚信代码签名测试证书SHA2,O=亚数信息科技（上海）有限公司,L=上海市,ST=上海市,C=CN

Serial Number

Issuer

CN=TrustAsia SHA2 Code Signing CA,O=TrustAsia Technologies\, Inc.,C=CN

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 29, 2018 - Jan 29, 2020

Subject

CN=TrustAsia SHA2 Code Signing CA,O=TrustAsia Technologies\, Inc.,C=CN

Serial Number

Issuer

CN=TrustAsia Root CA,O=TrustAsia Technologies\, Inc.,C=CN

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

Jan 1, 2015 - Dec 30, 2025

Minor OS version

Major OS version

Entry point

10721

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

_lclose GetModuleFileNameA _lread _llseek _lopen _lwrite _lcreat CreateDirectoryA SetCurrentDirectoryA lstrcatA FreeLibrary GetProcAddress LoadLibraryA GetDiskFreeSpaceA GetFileAttributesA RemoveDirectoryA DeleteFileA lstrlenA GetCurrentDirectoryA CloseHandle GetExitCodeProcess GetLastError LocalFree GetCurrentProcess MoveFileExA Sleep GetStringTypeW MultiByteToWideChar LCMapStringW HeapReAlloc RtlUnwind HeapSize lstrcpyA GetTempPathA CompareStringA IsValidCodePage GetOEMCP GetModuleHandleW ExitProcess DecodePointer HeapFree HeapAlloc GetCommandLineA HeapSetInformation GetStartupInfoW InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer LoadLibraryW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement WriteFile GetStdHandle GetModuleFileNameW IsProcessorFeaturePresent HeapCreate FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP

user32

TranslateMessage DispatchMessageA PeekMessageA wsprintfA LoadCursorA SetCursor MessageBoxA MsgWaitForMultipleObjects

advapi32

GetTokenInformation OpenProcessToken

shell32

ShellExecuteExA

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_fd1c262a873ade5c0a346742fe8c1120_amadey_cloudeye_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

PE Signature issue

PE Signature issue

kernel32

user32

advapi32

shell32

generic