2026-10-22_98bfb98a3e372240763a6f0caa0f72f5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

General

Target
2026-10-22_98bfb98a3e372240763a6f0caa0f72f5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
Size 14.1MB
Sample261024-d64esastbs
SHA256 d802c4936f0a8c092ec92a2f40d9c6746a07f0cf4affda21605fecef924888e5
MD5 98bfb98a3e372240763a6f0caa0f72f5
SHA1 0b688804d7340252f1464ade2ab82bf518c2a3f3
SHA512 4a042e7a6965bf32aca6b846178342733cc3f5c2f76719749a3167fe6e6b8024666c184c84d35e4b87d013753600d9b1a5409f0ebb716a7578b79cde4899fede
SSDEEP 3072:Q05Xaz5ADFeLcYUL0raX1cmS7d/zCpmHbj9nGezTWJPUKX5hzT4SNN4SNN4SNN48:QEM6YUL02lcmErCYGezTYdD
TLSH
T118E65B2255B62570C87D417D3B0C774C2AEFF7F2B2E4A2BA9129A5C40813B8D55C6E3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_98bfb98a3e372240763a6f0caa0f72f5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-10-22_98bfb98a3e372240763a6f0caa0f72f5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

.exe 14.1MB

2026-10-22_98bfb98a3e372240763a6f0caa0f72f5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

IMPHASH e33fc10ac8b1ad5a04646026b94890a5
SHA256 d802c4936f0a8c092ec92a2f40d9c6746a07f0cf4affda21605fecef924888e5
MD5 98bfb98a3e372240763a6f0caa0f72f5
SHA1 0b688804d7340252f1464ade2ab82bf518c2a3f3
SHA512 4a042e7a6965bf32aca6b846178342733cc3f5c2f76719749a3167fe6e6b8024666c184c84d35e4b87d013753600d9b1a5409f0ebb716a7578b79cde4899fede
SSDEEP 3072:Q05Xaz5ADFeLcYUL0raX1cmS7d/zCpmHbj9nGezTWJPUKX5hzT4SNN4SNN4SNN48:QEM6YUL02lcmErCYGezTYdD
TLSH
T118E65B2255B62570C87D417D3B0C774C2AEFF7F2B2E4A2BA9129A5C40813B8D55C6E3B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

35689

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\gahor-45\yakol yabegav bazavebawetose\locuyuciw.pdb

kernel32

GetConsoleAliasExesLengthA GetCommState WaitNamedPipeA GetLogicalDriveStringsW GlobalSize CreateHardLinkA WaitForSingleObjectEx ReadConsoleW EnumResourceTypesA SetHandleCount LoadLibraryW GetConsoleMode InterlockedPopEntrySList lstrcpynW GetWriteWatch GetFileAttributesW WriteConsoleW GetModuleFileNameW GetCompressedFileSizeA CreateActCtxA WritePrivateProfileStringW GetConsoleAliasesW GetStdHandle SetLastError GetProcAddress VirtualAlloc BeginUpdateResourceW EnumSystemCodePagesW FindResourceExW SearchPathA LoadLibraryA LocalAlloc DnsHostnameToComputerNameA WriteProfileSectionW FoldStringA GetModuleHandleA GetCommTimeouts FreeEnvironmentStringsW GetConsoleTitleW GetShortPathNameW DeleteTimerQueueTimer GlobalAddAtomW DebugBreak ReadConsoleOutputCharacterW EnumCalendarInfoExA DeleteFileA FlushFileBuffers CloseHandle CreateFileA GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoW GetConsoleCP GetNumaProcessorNode IsBadStringPtrW FindVolumeClose CreateMemoryResourceNotification SetDefaultCommConfigA InterlockedIncrement InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter GetLastError HeapFree MultiByteToWideChar TerminateProcess GetCurrentProcess IsDebuggerPresent GetStartupInfoW RtlUnwind RaiseException LCMapStringA WideCharToMultiByte LCMapStringW GetCPInfo GetModuleHandleW ExitProcess WriteFile GetModuleFileNameA HeapAlloc HeapCreate VirtualFree HeapReAlloc GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId GetEnvironmentStringsW GetCommandLineW GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapSize GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW InitializeCriticalSectionAndSpinCount SetFilePointer

user32

ToAsciiEx LoadBitmapA LoadMenuA IsWindowEnabled MessageBoxIndirectA DrawEdge GetScrollInfo GetWindowLongW GetKeyNameTextW ModifyMenuA

gdi32

GetCharABCWidthsA CreateDiscardableBitmap GetCharWidthI

advapi32

GetEventLogInformation

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_98bfb98a3e372240763a6f0caa0f72f5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

kernel32

user32

gdi32

advapi32

generic