2026-10-30_c53b2beae8708b7ef60354aca8706ed1_elex_redline-stealer_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-30_c53b2beae8708b7ef60354aca8706ed1_elex_redline-stealer_smoke-loader
Size 1.3MB
Sample261030-v2ts8aey9n
SHA256 303c914d96e2ce8414f1a2aafd586884b62aa96a65da8125eb5583220cdf35fe
MD5 c53b2beae8708b7ef60354aca8706ed1
SHA1 11c88e4668be5d82b2998e1fbe9ef9a6ca94e7c4
SHA512 1f7ffef949e0fb061ca24d108a19a97618a38ab51f9a6862d60f3875d09a4f37027abc5bcf3df14352d8b1f1e51cd3afc8c54834cd017af77fdb2456a8581d6c
SSDEEP 24576:PIUX5qsJ5wDYP+gyiiZN70EgYnoBfQF0+bXWHSmojsWJUP7L0L:lX5ejiaNpgBfQF0cGHSmojfJUP7AL
TLSH
T195557C02F7EAC032EDA3297D4836661E5A7EB5451B38C9DB53942E1F49333C2983A357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-30_c53b2beae8708b7ef60354aca8706ed1_elex_redline-stealer_smoke-loader

File Explorer

2026-10-30_c53b2beae8708b7ef60354aca8706ed1_elex_redline-stealer_smoke-loader

.exe 1.3MB

2026-10-30_c53b2beae8708b7ef60354aca8706ed1_elex_redline-stealer_smoke-loader

IMPHASH 58682990e4231def0436e54a6a7fc9d9
SHA256 303c914d96e2ce8414f1a2aafd586884b62aa96a65da8125eb5583220cdf35fe
MD5 c53b2beae8708b7ef60354aca8706ed1
SHA1 11c88e4668be5d82b2998e1fbe9ef9a6ca94e7c4
SHA512 1f7ffef949e0fb061ca24d108a19a97618a38ab51f9a6862d60f3875d09a4f37027abc5bcf3df14352d8b1f1e51cd3afc8c54834cd017af77fdb2456a8581d6c
SSDEEP 24576:PIUX5qsJ5wDYP+gyiiZN70EgYnoBfQF0+bXWHSmojsWJUP7L0L:lX5ejiaNpgBfQF0cGHSmojfJUP7AL
TLSH
T195557C02F7EAC032EDA3297D4836661E5A7EB5451B38C9DB53942E1F49333C2983A357
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

854345

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\build\ob\bora-238809\vos3\thinstall\os\os_exe__Release2008\os_exe.pdb

ntdll

RtlUpcaseUnicodeChar RtlUnicodeStringToAnsiString RtlTryEnterCriticalSection RtlSetCurrentDirectory_U RtlNtStatusToDosError RtlLeaveCriticalSection RtlInitUnicodeString RtlInitializeCriticalSection RtlImageNtHeader RtlFreeUnicodeString RtlFreeAnsiString RtlEqualUnicodeString RtlEnterCriticalSection RtlDosPathNameToNtPathName_U RtlDestroyProcessParameters RtlCreateProcessParameters NtWriteVirtualMemory NtWriteFile NtUnmapViewOfSection NtTerminateThread NtTerminateProcess NtSetValueKey NtSetInformationThread NtSetInformationProcess NtSetInformationFile NtSetEvent NtSetDefaultLocale NtResumeThread NtReadVirtualMemory NtReadFile NtRaiseHardError NtQueryVolumeInformationFile NtQueryVirtualMemory NtQueryValueKey NtQuerySymbolicLinkObject NtQuerySecurityObject NtQuerySection NtQueryKey NtQueryInformationThread NtQueryInformationProcess NtQueryInformationFile NtQueryFullAttributesFile NtQueryDirectoryFile NtQueryDefaultLocale NtQueryAttributesFile NtProtectVirtualMemory NtOpenThread NtOpenSymbolicLinkObject NtOpenSection NtOpenKey NtOpenFile NtMapViewOfSection NtFsControlFile NtFreeVirtualMemory NtFlushKey NtEnumerateValueKey NtEnumerateKey NtDuplicateObject NtDeleteValueKey NtDeleteKey NtCreateThread NtCreateSection NtCreateProcess NtCreateKey NtCreateFile NtClose NtAllocateVirtualMemory CsrFreeCaptureBuffer CsrClientCallServer CsrAllocateMessagePointer

oleaut32

SafeArrayAccessData SafeArrayGetLBound SafeArrayGetUBound SafeArrayUnaccessData SysAllocString SysAllocStringLen SysFreeString SysStringLen VariantClear

gdi32

AddFontResourceW CombineRgn CreateCompatibleDC CreateDCA CreateDIBitmap CreateDIBSection CreateFontIndirectW CreateFontW CreateRectRgn CreateSolidBrush DeleteDC DeleteObject ExtCreateRegion GetObjectW GetStockObject GetTextCharset LineTo MoveToEx RemoveFontResourceW SelectObject SetBkMode SetDIBits SetTextColor BitBlt

kernel32

ExitProcess ExitThread ExpandEnvironmentStringsW FatalAppExitA FileTimeToSystemTime FindClose FindFirstChangeNotificationA FindFirstChangeNotificationW FindFirstFileA FindFirstFileExW FindFirstFileW FindNextFileA FindNextFileW FindResourceA FindResourceW FlushFileBuffers FormatMessageW FreeEnvironmentStringsA FreeEnvironmentStringsW FreeLibrary GetACP GetCommandLineA GetCommandLineW GetComputerNameW GetConsoleCP GetConsoleMode GetConsoleOutputCP GetCPInfo GetCurrencyFormatA GetCurrencyFormatW GetCurrentDirectoryA GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatA GetDateFormatW GetDiskFreeSpaceExW GetDiskFreeSpaceW GetDriveTypeW GetEnvironmentStrings GetEnvironmentStringsW GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeProcess GetExitCodeThread GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileSize GetFileTime GetFileType GetFullPathNameA GetFullPathNameW GetHandleInformation GetLastError GetLocaleInfoA GetLocaleInfoW GetLogicalDrives GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetNumberFormatA GetNumberFormatW GetOEMCP GetPrivateProfileIntA GetPrivateProfileIntW CreateConsoleScreenBuffer GetPrivateProfileSectionNamesA GetPrivateProfileSectionNamesW GetPrivateProfileSectionW GetPrivateProfileStringA GetPrivateProfileStringW GetPrivateProfileStructA GetPrivateProfileStructW GetProcAddress GetProcessHeap GetProfileIntA GetProfileIntW GetProfileSectionA GetProfileSectionW GetProfileStringA GetProfileStringW GetShortPathNameW GetStartupInfoA GetStartupInfoW GetStdHandle GetStringTypeA GetStringTypeW GetSystemDefaultLangID GetSystemDefaultLCID GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadLocale GetTickCount GetTimeFormatA GetTimeFormatW GetTimeZoneInformation GetUserDefaultLangID GetUserDefaultLCID GetVersion GetVersionExA GetVersionExW GetVolumeInformationW GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HeapValidate InitializeCriticalSection InitializeCriticalSectionAndSpinCount IsDBCSLeadByteEx EnterCriticalSection IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringA LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadResource LocalAlloc LocalFree LockResource lstrcmpiW lstrcpynA lstrlenA lstrlenW MapViewOfFile MoveFileA MoveFileExA MoveFileExW MoveFileW MultiByteToWideChar OpenEventA OpenEventW OpenFile OpenFileMappingW OpenMutexW OpenProcess OpenSemaphoreW OutputDebugStringA OutputDebugStringW QueryDosDeviceW QueryPerformanceCounter QueryPerformanceFrequency QueueUserAPC RaiseException CopyFileW ReadFile ReadProcessMemory ReleaseMutex ReleaseSemaphore RemoveDirectoryA RemoveDirectoryW ResumeThread RtlUnwind SearchPathA SearchPathW SetConsoleCtrlHandler SetCurrentDirectoryA SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableA SetEnvironmentVariableW SetEvent SetFileAttributesA SetFileAttributesW SetFilePointer SetFileTime SetHandleCount SetLastError SetLocaleInfoA SetLocaleInfoW SetPriorityClass SetProcessAffinityMask SetProcessPriorityBoost SetProcessWorkingSetSize SetStdHandle SetThreadAffinityMask SetThreadContext SetThreadIdealProcessor SetThreadLocale SetThreadPriority SetThreadPriorityBoost SetUnhandledExceptionFilter SizeofResource Sleep SuspendThread SystemTimeToFileTime TerminateProcess TerminateThread TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter UnmapViewOfFile VirtualAlloc VirtualAllocEx VirtualFree VirtualFreeEx VirtualProtect VirtualProtectEx VirtualQuery VirtualQueryEx WaitForDebugEvent WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteConsoleA WriteConsoleW WritePrivateProfileSectionA WritePrivateProfileSectionW WritePrivateProfileStringA WritePrivateProfileStringW WritePrivateProfileStructA WritePrivateProfileStructW WriteProcessMemory WriteProfileStringA WriteProfileStringW CopyFileExW EnumResourceNamesW EnumSystemLocalesA CopyFileA ContinueDebugEvent CompareStringW CompareStringA CompareFileTime CloseHandle AddAtomW _lopen _lcreat WriteFile DuplicateHandle DeleteFileW DeleteFiber DeleteCriticalSection DebugBreak DebugActiveProcess CreateThread CreateSemaphoreW CreateRemoteThread CreateProcessW CreateProcessA CreateNamedPipeW CreateNamedPipeA CreateMutexW CreateFileW CreateFileMappingW CreateFileA CreateEventW CreateEventA CreateDirectoryW CreateDirectoryExW CreateDirectoryExA IsDebuggerPresent CreateDirectoryA GetPrivateProfileSectionA

advapi32

SetServiceBits SetSecurityDescriptorSacl SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl SetNamedSecurityInfoW SetFileSecurityW SetFileSecurityA SetEntriesInAclW RevertToSelf RegSetValueW RegSetValueExW RegSetValueExA RegSetValueA RegQueryValueW RegQueryValueExW RegQueryValueExA RegQueryValueA RegQueryInfoKeyW RegOpenKeyW RegOpenKeyExW RegisterServiceCtrlHandlerW RegisterServiceCtrlHandlerA RegEnumValueW RegEnumKeyExW RegEnumKeyExA RegDeleteValueW RegDeleteValueA RegDeleteKeyW RegDeleteKeyA RegCreateKeyExW RegCloseKey QueryServiceStatusEx QueryServiceStatus QueryServiceObjectSecurity QueryServiceLockStatusW QueryServiceLockStatusA QueryServiceConfigW QueryServiceConfigA OpenThreadToken OpenServiceW OpenServiceA OpenSCManagerW OpenSCManagerA OpenProcessToken MapGenericMask MakeSelfRelativeSD MakeAbsoluteSD LookupAccountNameW LogonUserW LogonUserA LockServiceDatabase IsValidSid IsValidSecurityDescriptor InitializeSecurityDescriptor ImpersonateSelf GetUserNameW GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority GetSidIdentifierAuthority GetServiceKeyNameW GetServiceKeyNameA GetServiceDisplayNameW GetServiceDisplayNameA GetSecurityInfo GetSecurityDescriptorSacl GetSecurityDescriptorOwner GetSecurityDescriptorLength GetSecurityDescriptorGroup UnlockServiceDatabase StartServiceW StartServiceCtrlDispatcherW StartServiceCtrlDispatcherA StartServiceA SetTokenInformation SetServiceStatus SetServiceObjectSecurity GetNamedSecurityInfoW GetLengthSid GetFileSecurityW FreeSid EqualSid EnumServicesStatusW EnumServicesStatusExW EnumServicesStatusExA EnumServicesStatusA EnumDependentServicesW EnumDependentServicesA DuplicateTokenEx DuplicateToken DeleteService CryptVerifySignatureW CryptSignHashW CryptReleaseContext CryptImportKey CryptHashData CryptGetHashParam CryptDestroyKey CryptDestroyHash CryptCreateHash CryptAcquireContextW CreateServiceW CreateServiceA CreateProcessAsUserW CreateProcessAsUserA CopySid ControlService CloseServiceHandle ChangeServiceConfigW ChangeServiceConfigA AllocateAndInitializeSid AccessCheck GetSecurityDescriptorDacl GetSecurityDescriptorControl

ole32

CoRevokeClassObject WriteClassStg StringFromGUID2 StringFromCLSID StgOpenStorage OleUninitialize OleRun OleLoad OleGetAutoConvert OleDoAutoConvert CLSIDFromString CoCreateGuid CoCreateInstance CoGetClassObject CoGetMalloc CoInitialize CoRegisterClassObject CoTaskMemAlloc CoTaskMemFree CoUninitialize CreateBindCtx OleCreate OleCreateDefaultHandler

user32

BeginPaint CharLowerW CharNextExA CharUpperW CloseClipboard CloseDesktop CloseWindowStation CreateDialogParamW CreateIconFromResource CreateIconFromResourceEx CreateWindowExW DefWindowProcA DefWindowProcW DestroyMenu DestroyWindow DispatchMessageW DrawIconEx DrawTextW EnableWindow EndPaint FillRect FindWindowA FindWindowExW FindWindowW GetClassInfoA GetClassInfoW GetClientRect GetDC GetDesktopWindow GetDlgItem GetMessageA GetMessageW GetParent GetProcessWindowStation GetSysColor GetSysColorBrush GetSystemMetrics GetUserObjectInformationW GetWindow GetWindowLongW GetWindowRect GetWindowThreadProcessId IsDialogMessageW IsWindow IsWindowVisible KillTimer LoadCursorFromFileA LoadCursorFromFileW LoadCursorW LoadIconW LoadImageA LoadImageW LoadMenuA LoadMenuW LoadStringW LookupIconIdFromDirectoryEx MessageBoxW OpenClipboard OpenDesktopW OpenInputDesktop OpenWindowStationW PeekMessageA PeekMessageW PostQuitMessage RedrawWindow RegisterClassExW RegisterClassW ReleaseCapture ReleaseDC SendMessageA SendMessageW SetCapture SetClipboardData SetCursor SetProcessWindowStation SetRect SetTimer SetUserObjectSecurity SetWindowLongW SetWindowPos SetWindowRgn SetWindowsHookExA SetWindowsHookExW ShowWindow SystemParametersInfoW TranslateMessage UnregisterClassW WaitForInputIdle WinHelpA WinHelpW wvsprintfW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-30_c53b2beae8708b7ef60354aca8706ed1_elex_redline-stealer_smoke-loader

ntdll

oleaut32

gdi32

kernel32

advapi32

ole32

user32

generic