2026-10-24_b9cccaee5f85f477c748dc686071f01e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

General

Target
2026-10-24_b9cccaee5f85f477c748dc686071f01e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
Size 13.5MB
Sample261025-ltwheayzgs
SHA256 bcd28721dd115dc8e410e65c7ff3f36d10976dd9147765fb71b7a20868f27b3a
MD5 b9cccaee5f85f477c748dc686071f01e
SHA1 ca81392a0e9300b99c7aa7548facb21b9f521f10
SHA512 5d0e3ccbf22a34c5ae4f4001e6208bbe570230c62aab991aca2ae5ab8a941356f85f679c66ff68e1282cb0fc3532ead2383ed29689bda9ae4c75b1f4e3435f12
SSDEEP 6144:Aq97LjFOKlbnh15S3pXF/iDuKkEn2E1a:AqV3FOKxnh1sEuzUv
TLSH
T15CE63B370A680846D06AD4BDBF9DBF1C89DCB3B0B0584B6B035595D9AD0332B6AFD187
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-24_b9cccaee5f85f477c748dc686071f01e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

File Explorer

2026-10-24_b9cccaee5f85f477c748dc686071f01e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

.exe 13.5MB

2026-10-24_b9cccaee5f85f477c748dc686071f01e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

IMPHASH 3ede86ea15bd6a919edb55c89cba6a2d
SHA256 bcd28721dd115dc8e410e65c7ff3f36d10976dd9147765fb71b7a20868f27b3a
MD5 b9cccaee5f85f477c748dc686071f01e
SHA1 ca81392a0e9300b99c7aa7548facb21b9f521f10
SHA512 5d0e3ccbf22a34c5ae4f4001e6208bbe570230c62aab991aca2ae5ab8a941356f85f679c66ff68e1282cb0fc3532ead2383ed29689bda9ae4c75b1f4e3435f12
SSDEEP 6144:Aq97LjFOKlbnh15S3pXF/iDuKkEn2E1a:AqV3FOKxnh1sEuzUv
TLSH
T15CE63B370A680846D06AD4BDBF9DBF1C89DCB3B0B0584B6B035595D9AD0332B6AFD187
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

26383

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\gopekoxe_junonipozagini\pepo.pdb

kernel32

GetSystemDefaultLangID SetProcessAffinityMask GetStringTypeA WriteConsoleOutputCharacterA OpenJobObjectA GetCommState WaitNamedPipeA CreateHardLinkA GetModuleHandleW GetTickCount GetVolumePathNameW GetPrivateProfileIntA LoadLibraryW CopyFileW GetFileAttributesA GetFileAttributesW lstrlenW LCMapStringA GetConsoleAliasesW GetLastError GetProcAddress VirtualAlloc SetComputerNameA WriteConsoleA LocalAlloc SetProcessWorkingSetSize GetModuleHandleA CreateMutexA FindNextFileW GetFileAttributesExW AddConsoleAliasA GetTempPathA WriteProcessMemory LCMapStringW Sleep ExitProcess GetStartupInfoW HeapAlloc HeapFree TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapSize EnterCriticalSection LeaveCriticalSection TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage CloseHandle WriteFile GetModuleFileNameA LoadLibraryA InitializeCriticalSectionAndSpinCount GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime HeapReAlloc WideCharToMultiByte CreateFileA SetFilePointer GetConsoleCP GetConsoleMode MultiByteToWideChar GetStringTypeW GetLocaleInfoA SetStdHandle FlushFileBuffers SetEndOfFile GetProcessHeap ReadFile RaiseException GetConsoleOutputCP WriteConsoleW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-24_b9cccaee5f85f477c748dc686071f01e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

kernel32

generic