2026-10-22_0471e920a6fe3f2c342a69b8e18f8c95_elex_redline-stealer_rhadamanthys_stop

General

Target
2026-10-22_0471e920a6fe3f2c342a69b8e18f8c95_elex_redline-stealer_rhadamanthys_stop
Size 1.3MB
Sample261024-2w14nsfh83
SHA256 733caeea3267059e0733bc9cc7cf1e2d23dbb3171b24fc9f51f77a85de8761a0
MD5 0471e920a6fe3f2c342a69b8e18f8c95
SHA1 0e141ea3074155a0a9c1570c96b78f076dc37ada
SHA512 66a390563f382e3ce50d7a1521e77253e7b0f31b635e1c0d4611b2adf8ed075d29df94596d7770526aa4c5d751149831303f7b4e70f2333cc848561b0c6ab438
SSDEEP 12288:E6pYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw2:Vye/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1AD55239A7AE1C173C97652713834C7F1139BACB12A70B483F5853FAB9FB0AE5561120E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_0471e920a6fe3f2c342a69b8e18f8c95_elex_redline-stealer_rhadamanthys_stop

File Explorer

2026-10-22_0471e920a6fe3f2c342a69b8e18f8c95_elex_redline-stealer_rhadamanthys_stop

.exe 1.3MB

2026-10-22_0471e920a6fe3f2c342a69b8e18f8c95_elex_redline-stealer_rhadamanthys_stop

IMPHASH 0f049ce24e217892c1b7f2d56270827d
SHA256 733caeea3267059e0733bc9cc7cf1e2d23dbb3171b24fc9f51f77a85de8761a0
MD5 0471e920a6fe3f2c342a69b8e18f8c95
SHA1 0e141ea3074155a0a9c1570c96b78f076dc37ada
SHA512 66a390563f382e3ce50d7a1521e77253e7b0f31b635e1c0d4611b2adf8ed075d29df94596d7770526aa4c5d751149831303f7b4e70f2333cc848561b0c6ab438
SSDEEP 12288:E6pYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw2:Vye/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1AD55239A7AE1C173C97652713834C7F1139BACB12A70B483F5853FAB9FB0AE5561120E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

9703

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GenerateConsoleCtrlEvent GetExitCodeProcess WaitForSingleObject CreateProcessA SetConsoleCtrlHandler GetModuleFileNameA EnterCriticalSection LeaveCriticalSection GetModuleHandleW Sleep GetProcAddress ExitProcess GetCommandLineA SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetLastError HeapFree HeapAlloc GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId WriteFile LoadLibraryA InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind HeapReAlloc VirtualAlloc GetConsoleCP GetConsoleMode FlushFileBuffers LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetFilePointer HeapSize CloseHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA CompareStringA CompareStringW SetEnvironmentVariableA ReadFile SetEndOfFile GetProcessHeap GetFileAttributesA

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_0471e920a6fe3f2c342a69b8e18f8c95_elex_redline-stealer_rhadamanthys_stop

kernel32

generic