2026-10-30_9b8062dc6cf4383fe6c1c96e0fe4d196_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

General

Target
2026-10-30_9b8062dc6cf4383fe6c1c96e0fe4d196_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 11.8MB
Sample261031-18malsae94
SHA256 2f21f8eadefd646b5f32e3f14061c4c7073c8da9d5e527f0effc9c18a3a101f4
MD5 9b8062dc6cf4383fe6c1c96e0fe4d196
SHA1 af235de1dc6463a09462df898a4f97be05c82ac5
SHA512 4e412cb845fd3c47f127db667fc0d4633dfadd9b5af17d8f3cd23e28a947afa4be753f01fe1b0b287b7dca1eeeed0a6e24cc89ad419bbf4f6afdfe64f7032e11
SSDEEP 24576:3COUruvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv:3TUr
TLSH
T1F4C67B01BBE55D89F6A56E305862BBD01337FD56A9F0A60AE750E7CF1CB33508962323
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-30_9b8062dc6cf4383fe6c1c96e0fe4d196_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-10-30_9b8062dc6cf4383fe6c1c96e0fe4d196_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 11.8MB

2026-10-30_9b8062dc6cf4383fe6c1c96e0fe4d196_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH 52f3cbaa89ec222f54fb6ad33fd12ebf
SHA256 2f21f8eadefd646b5f32e3f14061c4c7073c8da9d5e527f0effc9c18a3a101f4
MD5 9b8062dc6cf4383fe6c1c96e0fe4d196
SHA1 af235de1dc6463a09462df898a4f97be05c82ac5
SHA512 4e412cb845fd3c47f127db667fc0d4633dfadd9b5af17d8f3cd23e28a947afa4be753f01fe1b0b287b7dca1eeeed0a6e24cc89ad419bbf4f6afdfe64f7032e11
SSDEEP 24576:3COUruvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv:3TUr
TLSH
T1F4C67B01BBE55D89F6A56E305862BBD01337FD56A9F0A60AE750E7CF1CB33508962323
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

16068

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\hoyewi\papa\medidegirexiya\ficesocumugo.pdb

kernel32

GetDefaultCommConfigW LoadResource GetSystemWindowsDirectoryW QueryPerformanceCounter GetEnvironmentStringsW SetConsoleScreenBufferSize BackupSeek GetTickCount GetProcessHeap GetSystemTimeAsFileTime ReadConsoleW GetFirmwareEnvironmentVariableA GetProcessHandleCount InitAtomTable HeapValidate HeapCompact WriteConsoleW DeactivateActCtx LCMapStringA GetConsoleOutputCP SetLastError GetProcAddress VirtualAlloc BeginUpdateResourceW GetAtomNameA LoadLibraryA LocalAlloc GetModuleFileNameA GetConsoleCursorInfo DeleteAtom AddConsoleAliasA FindNextVolumeA lstrcpyW CommConfigDialogW SetProcessAffinityMask CreateFileW GetLastError HeapReAlloc GetModuleHandleW ExitProcess DecodePointer GetCommandLineA HeapSetInformation GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TerminateProcess GetCurrentProcess HeapAlloc EnterCriticalSection LeaveCriticalSection IsProcessorFeaturePresent SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection SetFilePointer HeapCreate HeapFree CloseHandle LoadLibraryW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement WriteFile GetModuleFileNameW FreeEnvironmentStringsW WideCharToMultiByte GetCurrentProcessId Sleep GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind RaiseException SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers HeapSize LCMapStringW MultiByteToWideChar GetStringTypeW

user32

ShowCursor

advapi32

AdjustTokenGroups

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-30_9b8062dc6cf4383fe6c1c96e0fe4d196_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

kernel32

user32

advapi32

generic