2026-10-22_29099051393c9a66d01f770192c37d37_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_29099051393c9a66d01f770192c37d37_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
Size 67KB
Sample261024-w291wafe23
SHA256 94cbaf2e697cd3704480cd70071f25a7f24a3c5990c639652b1a853a31773d41
MD5 29099051393c9a66d01f770192c37d37
SHA1 3ea32a26e1a6e81eb79764a77b3f82528d93e6ad
SHA512 10ab0e1bee018e1d1e146c4e115eb85f612b659ca577e60176e5087aa342f66beab32dbf6623a2350355aae116c1c9cc741c4cd51030c77ba0ce62b4a6116b7d
SSDEEP 1536:kK9znlIWn22lWZH6Lp1S/CLwjRPo2BE50Qn7k:kKgieH6LEj22BE50y4
TLSH
T18F638E237A50D036D85264702865C372AE7F783216B4C483BB5557BD8F723D9BB2E38A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-22_29099051393c9a66d01f770192c37d37_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

.exe 67KB

2026-10-22_29099051393c9a66d01f770192c37d37_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 1b484cfef2c447888557c53cff5fa677
SHA256 94cbaf2e697cd3704480cd70071f25a7f24a3c5990c639652b1a853a31773d41
MD5 29099051393c9a66d01f770192c37d37
SHA1 3ea32a26e1a6e81eb79764a77b3f82528d93e6ad
SHA512 10ab0e1bee018e1d1e146c4e115eb85f612b659ca577e60176e5087aa342f66beab32dbf6623a2350355aae116c1c9cc741c4cd51030c77ba0ce62b4a6116b7d
SSDEEP 1536:kK9znlIWn22lWZH6Lp1S/CLwjRPo2BE50Qn7k:kKgieH6LEj22BE50y4
TLSH
T18F638E237A50D036D85264702865C372AE7F783216B4C483BB5557BD8F723D9BB2E38A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

58:2b:b4:46:6e:7e:c0:f3:54:ef:79:6a:88:bd:77:35:4f:1a:d5:9b:ca:68:5d:94:7c:2b:be:e1:b5:5d:86:13

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=SC252676,CN=N-ABLE TECHNOLOGIES LTD,O=N-ABLE TECHNOLOGIES LTD,L=Dundee,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 15, 2026

SERIALNUMBER=SC252676,CN=N-ABLE TECHNOLOGIES LTD,O=N-ABLE TECHNOLOGIES LTD,L=Dundee,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=SC252676,CN=N-ABLE TECHNOLOGIES LTD,O=N-ABLE TECHNOLOGIES LTD,L=Dundee,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

SERIALNUMBER=SC252676,CN=N-ABLE TECHNOLOGIES LTD,O=N-ABLE TECHNOLOGIES LTD,L=Dundee,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

03:40:78:24:36:70:99:c9:ca:b8:a0:8d:c3:91:2c:41

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 20, 2026 - Jun 21, 2027

Minor OS version

Major OS version

Entry point

6970

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Projects\MSPAnywhere\SysShell\Release\BASupSysShell.pdb

user32

PostMessageW EnumWindows GetWindowTextW GetWindowThreadProcessId

kernel32

GetCurrentThreadId CreateProcessW GenerateConsoleCtrlEvent OpenProcess GetExitCodeProcess TerminateProcess GetLastError WaitForMultipleObjects OpenSemaphoreW CloseHandle EnterCriticalSection LeaveCriticalSection GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection Sleep HeapFree GetModuleHandleW GetProcAddress ExitProcess WriteFile WideCharToMultiByte GetConsoleCP GetConsoleMode FlushFileBuffers GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount HeapAlloc HeapReAlloc VirtualAlloc LoadLibraryA WriteConsoleA GetConsoleOutputCP WriteConsoleW MultiByteToWideChar SetFilePointer SetStdHandle RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize GetLocaleInfoA CreateFileA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_29099051393c9a66d01f770192c37d37_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

user32

kernel32

generic