2026-10-26_7cb31636e943c3eb8db424085676e7be_amadey_cloudeye_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_7cb31636e943c3eb8db424085676e7be_amadey_cloudeye_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
Size 90.1MB
Sample261027-q3rb9sdv71
SHA256 dedc4cd686d7dcfe5b59a19ec90e206a2eccfad1ca6c6a4c1b72fa0237e71194
MD5 7cb31636e943c3eb8db424085676e7be
SHA1 7eba10e387a0026dac2d748d9721136cf61edb58
SHA512 0d58abbf7dc7b30fdcad2a33f5e716facd7f02d260fafd95382a8cbacf61cf38ddac6cf684c9ca7a3d36e7fb75b883b1fc05dc85c00fd27dd1586dcfafd8fcc7
SSDEEP 1572864:pO/lpK/3PKmFqGVlkziGOLgG2y3oJV00Eh7T2YXq+v/3yRy/bemmLtnF:pO/6/fKutVoTOF29NEh7T2Ya4/CySmmX
TLSH
T168283399F653DCB4C87F03B944E8465B2791B8646330B18BF3B1B7BA86657C54AB2303
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-10-26_7cb31636e943c3eb8db424085676e7be_amadey_cloudeye_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-10-26_7cb31636e943c3eb8db424085676e7be_amadey_cloudeye_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

.exe 90.1MB

2026-10-26_7cb31636e943c3eb8db424085676e7be_amadey_cloudeye_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 1ff847646487d56f85778df99ff3728a
SHA256 dedc4cd686d7dcfe5b59a19ec90e206a2eccfad1ca6c6a4c1b72fa0237e71194
MD5 7cb31636e943c3eb8db424085676e7be
SHA1 7eba10e387a0026dac2d748d9721136cf61edb58
SHA512 0d58abbf7dc7b30fdcad2a33f5e716facd7f02d260fafd95382a8cbacf61cf38ddac6cf684c9ca7a3d36e7fb75b883b1fc05dc85c00fd27dd1586dcfafd8fcc7
SSDEEP 1572864:pO/lpK/3PKmFqGVlkziGOLgG2y3oJV00Eh7T2YXq+v/3yRy/bemmLtnF:pO/6/fKutVoTOF29NEh7T2Ya4/CySmmX
TLSH
T168283399F653DCB4C87F03B944E8465B2791B8646330B18BF3B1B7BA86657C54AB2303
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX dump on OEP (original entry point)
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

c4:9b:a2:af:d5:f4:65:16:59:48:2b:71:2e:45:c0:fc:2c:a0:66:17:2c:e7:2d:73:b2:d2:f5:1e:b7:37:c6:6a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=亚洲诚信代码签名测试证书SHA2,O=亚数信息科技（上海）有限公司,L=上海市,ST=上海市,C=CN

Chains

Oct 26, 2026

CN=亚洲诚信代码签名测试证书SHA2,O=亚数信息科技（上海）有限公司,L=上海市,ST=上海市,C=CN

CN=TrustAsia SHA2 Code Signing CA,O=TrustAsia Technologies\, Inc.,C=CN

PE Signature issue

Digest

95:74:c0:25:e5:46:be:88:a9:f2:17:cd:20:af:d6:e5:da:2f:b7:60

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=亚洲诚信代码签名测试证书,O=亚数信息科技（上海）有限公司,L=上海市,ST=上海市,C=CN

Chains

Oct 26, 2026

CN=亚洲诚信代码签名测试证书,O=亚数信息科技（上海）有限公司,L=上海市,ST=上海市,C=CN

Subject

CN=亚洲诚信代码签名测试证书,O=亚数信息科技（上海）有限公司,L=上海市,ST=上海市,C=CN

Serial Number

Issuer

CN=TrustAsia Code Signing CA,O=TrustAsia Technologies\, Inc.,C=CN

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 29, 2018 - Jan 29, 2020

Subject

CN=TrustAsia Code Signing CA,O=TrustAsia Technologies\, Inc.,C=CN

Serial Number

Issuer

CN=TrustAsia Root CA,O=TrustAsia Technologies\, Inc.,C=CN

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

May 19, 2010 - May 19, 2020

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=亚洲诚信代码签名测试证书SHA2,O=亚数信息科技（上海）有限公司,L=上海市,ST=上海市,C=CN

Serial Number

Issuer

CN=TrustAsia SHA2 Code Signing CA,O=TrustAsia Technologies\, Inc.,C=CN

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 29, 2018 - Jan 29, 2020

Subject

CN=TrustAsia SHA2 Code Signing CA,O=TrustAsia Technologies\, Inc.,C=CN

Serial Number

Issuer

CN=TrustAsia Root CA,O=TrustAsia Technologies\, Inc.,C=CN

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

Jan 1, 2015 - Dec 30, 2025

Minor OS version

Major OS version

Entry point

10721

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

_lclose GetModuleFileNameA _lread _llseek _lopen _lwrite _lcreat CreateDirectoryA SetCurrentDirectoryA lstrcatA FreeLibrary GetProcAddress LoadLibraryA GetDiskFreeSpaceA GetFileAttributesA RemoveDirectoryA DeleteFileA lstrlenA GetCurrentDirectoryA CloseHandle GetExitCodeProcess GetLastError LocalFree GetCurrentProcess MoveFileExA Sleep GetStringTypeW MultiByteToWideChar LCMapStringW HeapReAlloc RtlUnwind HeapSize lstrcpyA GetTempPathA CompareStringA IsValidCodePage GetOEMCP GetModuleHandleW ExitProcess DecodePointer HeapFree HeapAlloc GetCommandLineA HeapSetInformation GetStartupInfoW InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer LoadLibraryW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement WriteFile GetStdHandle GetModuleFileNameW IsProcessorFeaturePresent HeapCreate FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP

user32

TranslateMessage DispatchMessageA PeekMessageA wsprintfA LoadCursorA SetCursor MessageBoxA MsgWaitForMultipleObjects

advapi32

GetTokenInformation OpenProcessToken

shell32

ShellExecuteExA

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_7cb31636e943c3eb8db424085676e7be_amadey_cloudeye_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

PE Signature issue

PE Signature issue

kernel32

user32

advapi32

shell32

generic