2026-10-26_be87471db4fbb8770fe7d5e1566594c5_elex_redline-stealer_rhadamanthys_stop

General

Target
2026-10-26_be87471db4fbb8770fe7d5e1566594c5_elex_redline-stealer_rhadamanthys_stop
Size 1.4MB
Sample261027-jscykact9k
SHA256 8fb2b373fc470080ec0c59cf36ee238f4b2017ea79448a63b0171073e33ca861
MD5 be87471db4fbb8770fe7d5e1566594c5
SHA1 bdda7df1fee13a840c0fef30bedad222da3aba06
SHA512 cb1c5f8b29bab275026922b791c01bcb7186d71e42bef918d38bbcb90dd7f55d7c9c65237db01a3139f3f4249a97fbb2c33b62de3238990ed6e86ff9cb6cdc9b
SSDEEP 24576:0ZsqjnhMgeiCl7G0nehbGZpbD8l8eOKaa+EUmUGhtgs4NmXEbZsLTQK1:0dDmg27RnWGjeJZHUmUYyH0UbETQK1
TLSH
T1426523F87108D176D42655B25798D1A69C027D7A06340D63FB53BBFBBF318A4C22E227
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_be87471db4fbb8770fe7d5e1566594c5_elex_redline-stealer_rhadamanthys_stop

File Explorer

2026-10-26_be87471db4fbb8770fe7d5e1566594c5_elex_redline-stealer_rhadamanthys_stop

.exe 1.4MB

2026-10-26_be87471db4fbb8770fe7d5e1566594c5_elex_redline-stealer_rhadamanthys_stop

IMPHASH ba2c974ed567c90fe365844af978f320
SHA256 8fb2b373fc470080ec0c59cf36ee238f4b2017ea79448a63b0171073e33ca861
MD5 be87471db4fbb8770fe7d5e1566594c5
SHA1 bdda7df1fee13a840c0fef30bedad222da3aba06
SHA512 cb1c5f8b29bab275026922b791c01bcb7186d71e42bef918d38bbcb90dd7f55d7c9c65237db01a3139f3f4249a97fbb2c33b62de3238990ed6e86ff9cb6cdc9b
SSDEEP 24576:0ZsqjnhMgeiCl7G0nehbGZpbD8l8eOKaa+EUmUGhtgs4NmXEbZsLTQK1:0dDmg27RnWGjeJZHUmUYyH0UbETQK1
TLSH
T1426523F87108D176D42655B25798D1A69C027D7A06340D63FB53BBFBBF318A4C22E227
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

9747

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GenerateConsoleCtrlEvent GetExitCodeProcess WaitForSingleObject CreateProcessA SetConsoleCtrlHandler GetModuleFileNameA EnterCriticalSection LeaveCriticalSection GetModuleHandleW Sleep GetProcAddress ExitProcess GetCommandLineA GetStartupInfoA SetHandleCount GetStdHandle GetFileType DeleteCriticalSection TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetLastError HeapFree HeapAlloc GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId WriteFile LoadLibraryA InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind HeapReAlloc VirtualAlloc GetConsoleCP GetConsoleMode FlushFileBuffers LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetFilePointer HeapSize CloseHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA CompareStringA CompareStringW SetEnvironmentVariableA ReadFile SetEndOfFile GetProcessHeap GetFileAttributesA

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_be87471db4fbb8770fe7d5e1566594c5_elex_redline-stealer_rhadamanthys_stop

kernel32

generic