2026-10-26_4e2aee65985e9e67c385782a5cb90952_elex_karagany_mafia_redline-stealer_rhadamanthys

General

Target
2026-10-26_4e2aee65985e9e67c385782a5cb90952_elex_karagany_mafia_redline-stealer_rhadamanthys
Size 1.3MB
Sample261027-wfmnfsez71
SHA256 2ffe00f9bb7e7ff55ec365ef2efaf3392f6175371dd0596a91633e5e3e87687a
MD5 4e2aee65985e9e67c385782a5cb90952
SHA1 5d1aefab2aff1f7dbc8584eecf9c7ca00148d1d7
SHA512 ffcd449293b4be3fab9c32cc47084c36c299fd02fe0ddd0f302d8130c20c80d273d857bd4e896c2f31e8722dbda6ce12d4554d9e1c8699a15687058b21015abf
SSDEEP 12288:l7ZtXTateu0VGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:ct61nQ/tbw/2Mkjy6Fr7g0oM
TLSH
T13C55122032D5D032E61325754956C7B24FBF7CB57AA1AA8F7FC906798F3C3909668309
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_4e2aee65985e9e67c385782a5cb90952_elex_karagany_mafia_redline-stealer_rhadamanthys

File Explorer

2026-10-26_4e2aee65985e9e67c385782a5cb90952_elex_karagany_mafia_redline-stealer_rhadamanthys

.exe 1.3MB

2026-10-26_4e2aee65985e9e67c385782a5cb90952_elex_karagany_mafia_redline-stealer_rhadamanthys

IMPHASH 86775e7a5bf20607bc75e315f16542ec
SHA256 2ffe00f9bb7e7ff55ec365ef2efaf3392f6175371dd0596a91633e5e3e87687a
MD5 4e2aee65985e9e67c385782a5cb90952
SHA1 5d1aefab2aff1f7dbc8584eecf9c7ca00148d1d7
SHA512 ffcd449293b4be3fab9c32cc47084c36c299fd02fe0ddd0f302d8130c20c80d273d857bd4e896c2f31e8722dbda6ce12d4554d9e1c8699a15687058b21015abf
SSDEEP 12288:l7ZtXTateu0VGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:ct61nQ/tbw/2Mkjy6Fr7g0oM
TLSH
T13C55122032D5D032E61325754956C7B24FBF7CB57AA1AA8F7FC906798F3C3909668309
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

12123

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Z:\b\QMI\win\qcwwan\tools\LogReader\Release\logReader.pdb

kernel32

CreateFileA ReadFile WriteFile CloseHandle GetLastError TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetProcAddress GetModuleHandleW ExitProcess DecodePointer HeapFree HeapAlloc GetCommandLineA HeapSetInformation EncodePointer WideCharToMultiByte GetTimeZoneInformation InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection FatalAppExitA EnterCriticalSection SetConsoleCtrlHandler FreeLibrary InterlockedExchange LoadLibraryW GetLocaleInfoW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCurrentThread GetStdHandle GetModuleFileNameW HeapCreate HeapDestroy GetCPInfo GetACP GetOEMCP IsValidCodePage GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime Sleep IsProcessorFeaturePresent HeapSize RtlUnwind SetFilePointer GetConsoleCP GetConsoleMode LCMapStringW MultiByteToWideChar GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale HeapReAlloc FlushFileBuffers SetStdHandle WriteConsoleW CompareStringW SetEnvironmentVariableA CreateFileW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_4e2aee65985e9e67c385782a5cb90952_elex_karagany_mafia_redline-stealer_rhadamanthys

kernel32

generic