2026-10-22_2be1783cfc1202c021e564f91d3a5727_elex_redline-stealer_rhadamanthys_stop

General

Target
2026-10-22_2be1783cfc1202c021e564f91d3a5727_elex_redline-stealer_rhadamanthys_stop
Size 1.3MB
Sample261024-wp4nbswsht
SHA256 31c6e4e6b8fcbde0391a121e0a5d12d6490f217d53d31d781a1f79aae33ba272
MD5 2be1783cfc1202c021e564f91d3a5727
SHA1 b11c74a3d75cdadc2f45613dbd4c4a92e74e9df0
SHA512 5907589267cb10fddd768d851d56eb3b77fc291d64fb46b13664bb299a2c621d55c53f6db053c4c56b665d22a9b54b9955090dbc6f98cc83be0f1e726f957c26
SSDEEP 12288:t5YYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywf:D9e/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1CC55239A7AE1C073C57652753438C7F1139BACB12A70B483F9853FAB6FB0AE1561120E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_2be1783cfc1202c021e564f91d3a5727_elex_redline-stealer_rhadamanthys_stop

File Explorer

2026-10-22_2be1783cfc1202c021e564f91d3a5727_elex_redline-stealer_rhadamanthys_stop

.exe 1.3MB

2026-10-22_2be1783cfc1202c021e564f91d3a5727_elex_redline-stealer_rhadamanthys_stop

IMPHASH ba2c974ed567c90fe365844af978f320
SHA256 31c6e4e6b8fcbde0391a121e0a5d12d6490f217d53d31d781a1f79aae33ba272
MD5 2be1783cfc1202c021e564f91d3a5727
SHA1 b11c74a3d75cdadc2f45613dbd4c4a92e74e9df0
SHA512 5907589267cb10fddd768d851d56eb3b77fc291d64fb46b13664bb299a2c621d55c53f6db053c4c56b665d22a9b54b9955090dbc6f98cc83be0f1e726f957c26
SSDEEP 12288:t5YYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywf:D9e/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1CC55239A7AE1C073C57652753438C7F1139BACB12A70B483F9853FAB6FB0AE1561120E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

9747

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GenerateConsoleCtrlEvent GetExitCodeProcess WaitForSingleObject CreateProcessA SetConsoleCtrlHandler GetModuleFileNameA EnterCriticalSection LeaveCriticalSection GetModuleHandleW Sleep GetProcAddress ExitProcess GetCommandLineA GetStartupInfoA SetHandleCount GetStdHandle GetFileType DeleteCriticalSection TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetLastError HeapFree HeapAlloc GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId WriteFile LoadLibraryA InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind HeapReAlloc VirtualAlloc GetConsoleCP GetConsoleMode FlushFileBuffers LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetFilePointer HeapSize CloseHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA CompareStringA CompareStringW SetEnvironmentVariableA ReadFile SetEndOfFile GetProcessHeap GetFileAttributesA

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_2be1783cfc1202c021e564f91d3a5727_elex_redline-stealer_rhadamanthys_stop

kernel32

generic