2026-10-22_df95ed536bcc5df1f03c1de83dea1e37_amadey_elex_redline-stealer_smoke-loader

General

Target
2026-10-22_df95ed536bcc5df1f03c1de83dea1e37_amadey_elex_redline-stealer_smoke-loader
Size 153KB
Sample261023-t657datv5m
SHA256 38c533edd00f13ad1f806ba913be59421b487d9eac4af4eb2b151ded574d331f
MD5 df95ed536bcc5df1f03c1de83dea1e37
SHA1 9550fa4c53493db7cd2601c7a1e9c51e1962ae19
SHA512 44a182c1250b5a099bdd7cad031a660eaaa87ee4f58e2419e7821a9cfe4d663cd6e06c0f64f625a333b86b6b43750f68cb5d834ca2336f8ce498982fa86b1923
SSDEEP 1536:wsd16B+FkQhCGlwyueRjLro3BBpBPkoAd5hbANPz:wsd16B0+QrHmRBbAd5hbANPz
TLSH
T10BF38C1079A0C073C04668359966C3B26F7DB5326EF9958B7FAA077D5F312C0AB3930A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_df95ed536bcc5df1f03c1de83dea1e37_amadey_elex_redline-stealer_smoke-loader

File Explorer

2026-10-22_df95ed536bcc5df1f03c1de83dea1e37_amadey_elex_redline-stealer_smoke-loader

.exe 153KB

2026-10-22_df95ed536bcc5df1f03c1de83dea1e37_amadey_elex_redline-stealer_smoke-loader

IMPHASH 101c57b0c9b86bb8d44f712960074bd8
SHA256 38c533edd00f13ad1f806ba913be59421b487d9eac4af4eb2b151ded574d331f
MD5 df95ed536bcc5df1f03c1de83dea1e37
SHA1 9550fa4c53493db7cd2601c7a1e9c51e1962ae19
SHA512 44a182c1250b5a099bdd7cad031a660eaaa87ee4f58e2419e7821a9cfe4d663cd6e06c0f64f625a333b86b6b43750f68cb5d834ca2336f8ce498982fa86b1923
SSDEEP 1536:wsd16B+FkQhCGlwyueRjLro3BBpBPkoAd5hbANPz:wsd16B0+QrHmRBbAd5hbANPz
TLSH
T10BF38C1079A0C073C04668359966C3B26F7DB5326EF9958B7FAA077D5F312C0AB3930A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

17116

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

NETFXSBS10.pdb

advapi32

RegDeleteValueA RegCreateKeyExA RegCloseKey RegSetValueExA

kernel32

GetSystemDirectoryA GetWindowsDirectoryA CloseHandle WaitForSingleObject CreateProcessA FindNextFileA FindFirstFileA GetTempPathA GetCommandLineA RtlUnwind EnterCriticalSection LeaveCriticalSection SetUnhandledExceptionFilter GetModuleHandleW Sleep GetProcAddress ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetLastError GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapCreate VirtualFree HeapFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent HeapAlloc RaiseException SetFilePointer LoadLibraryA InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage VirtualAlloc HeapReAlloc MultiByteToWideChar ReadFile HeapSize SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers CreateFileA GetLocaleInfoA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEndOfFile GetProcessHeap

shlwapi

SHDeleteKeyA

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_df95ed536bcc5df1f03c1de83dea1e37_amadey_elex_redline-stealer_smoke-loader

advapi32

kernel32

shlwapi

generic