2026-10-22_49dedbf0bac58fee6b00b988b437522b_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_49dedbf0bac58fee6b00b988b437522b_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
Size 2.6MB
Sample261024-rhf68scs5k
SHA256 0b11b4ddeeb6c5653552a37f0d3e12139cd92703d41f472d0905373bab7e9b2c
MD5 49dedbf0bac58fee6b00b988b437522b
SHA1 dcacae7655825b1aedb1e1439a4a7ff75dee4665
SHA512 9724af475632e1df4345db8b2eeb7cc1dadf513c9faed50b8413411d42dea04ad3adc2509729b8f3642a03a0f7d4e6e9e8f5e8e1184647375410193c2c77d1f4
SSDEEP 49152:xTCS9hWSytLoqUVbsNBk9/fw2BwfmM0f/Igek:sKstsFRsNi9XwgwfoRek
TLSH
T129C5292EFDA0AC31D56109304551F73C66286D209A1B6D47F298BE9EFBF2FC16619233
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_49dedbf0bac58fee6b00b988b437522b_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-10-22_49dedbf0bac58fee6b00b988b437522b_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

.exe 2.6MB

2026-10-22_49dedbf0bac58fee6b00b988b437522b_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

IMPHASH c13c1bdb7371583da62542f08c300c96
SHA256 0b11b4ddeeb6c5653552a37f0d3e12139cd92703d41f472d0905373bab7e9b2c
MD5 49dedbf0bac58fee6b00b988b437522b
SHA1 dcacae7655825b1aedb1e1439a4a7ff75dee4665
SHA512 9724af475632e1df4345db8b2eeb7cc1dadf513c9faed50b8413411d42dea04ad3adc2509729b8f3642a03a0f7d4e6e9e8f5e8e1184647375410193c2c77d1f4
SSDEEP 49152:xTCS9hWSytLoqUVbsNBk9/fw2BwfmM0f/Igek:sKstsFRsNi9XwgwfoRek
TLSH
T129C5292EFDA0AC31D56109304551F73C66286D209A1B6D47F298BE9EFBF2FC16619233
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27885

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

comctl32

CreatePropertySheetPageA PropertySheetA

kernel32

GetVersionExA DeleteFileA GetPrivateProfileIntA GetPrivateProfileStringA ResumeThread SetPriorityClass GetCurrentProcess GetCurrentThread SetThreadPriority CreateProcessA GetModuleFileNameA RemoveDirectoryA GetFileSize GetModuleHandleA GetTempPathA CreateDirectoryA GetFileAttributesA MapViewOfFile CreateFileMappingA CloseHandle SetFileTime GetStartupInfoA DosDateTimeToFileTime GetLastError CreateFileA SetLastError FreeLibrary FormatMessageA LocalFree MultiByteToWideChar LoadLibraryA GetProcAddress lstrlenA GetTempFileNameA UnmapViewOfFile

user32

SendMessageA GetFocus GetWindowRect RegisterClassA CreateWindowExA ShowWindow UpdateWindow LoadCursorA SetCursor PeekMessageA TranslateMessage DispatchMessageA GetDlgItem MessageBoxA MoveWindow GetDC ReleaseDC SendDlgItemMessageA GetParent wsprintfA SetDlgItemTextA PostMessageA DefWindowProcA BeginPaint GetSystemMetrics EndPaint

gdi32

DeleteObject TextOutA SetBkMode SelectObject CreateFontA CreateDIBitmap CreateSolidBrush SetTextColor

advapi32

RegCreateKeyExA RegOpenKeyExA RegQueryValueExA RegDeleteValueA RegDeleteKeyA RegCloseKey RegSetValueExA RegQueryValueA RegEnumKeyExA

shell32

ShellExecuteA

ole32

CoInitialize CoCreateInstance CoUninitialize

msvcr71

_acmdln exit _cexit _ismbblead _XcptFilter _exit _c_exit _amsg_exit __getmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _except_handler3 __dllonexit _onexit _controlfp _strnicmp _strcmpi _strdup _tempnam _close _read __p___argc __p___argv _open strncmp fgets realloc strchr memcpy memset strncat strcat strlen strcpy strcmp strrchr fprintf _vsnprintf malloc _snprintf strncpy free sscanf _putenv remove fread ftell fseek fopen fclose fflush freopen _iob fwrite strftime localtime time sprintf _fstat strtol _pctype _isctype __mb_cur_max qsort

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_49dedbf0bac58fee6b00b988b437522b_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

msvcr71

generic