2026-10-31_a0dcba34777e971c67c32680a92dcf15_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

General

Target
2026-10-31_a0dcba34777e971c67c32680a92dcf15_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
Size 269KB
Sample261031-pn1fyshd83
SHA256 2b82c97807b4f7133661916929627939139017f3f990fba6ce42482c42b7e9fd
MD5 a0dcba34777e971c67c32680a92dcf15
SHA1 8782f415db500dd1a7f67b6aa74994f045dcd9f1
SHA512 b2dab478715dbeca98745de64744562c7b9fb91928f9d23177b34e9174a15808a827dc527009970406fdd957783a08f7abf3c3c242f120cf58142baf2c44157f
SSDEEP 3072:VY3LZGLRan0Wbyv815UAbEkq+N5vQEzBypwa5aa5g52/mACf7IOcj/:a3LZGL8UADPDzQda2aR
TLSH
T10F443920A755DF2BF10690F2E823B0D6D367EAE68B1E0093D78077203D589D9A9E7735
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-31_a0dcba34777e971c67c32680a92dcf15_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

File Explorer

2026-10-31_a0dcba34777e971c67c32680a92dcf15_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

.exe 269KB

2026-10-31_a0dcba34777e971c67c32680a92dcf15_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

IMPHASH af455355974e9f87f1b4e5df199340d7
SHA256 2b82c97807b4f7133661916929627939139017f3f990fba6ce42482c42b7e9fd
MD5 a0dcba34777e971c67c32680a92dcf15
SHA1 8782f415db500dd1a7f67b6aa74994f045dcd9f1
SHA512 b2dab478715dbeca98745de64744562c7b9fb91928f9d23177b34e9174a15808a827dc527009970406fdd957783a08f7abf3c3c242f120cf58142baf2c44157f
SSDEEP 3072:VY3LZGLRan0Wbyv815UAbEkq+N5vQEzBypwa5aa5g52/mACf7IOcj/:a3LZGL8UADPDzQda2aR
TLSH
T10F443920A755DF2BF10690F2E823B0D6D367EAE68B1E0093D78077203D589D9A9E7735
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

00:9e:dc:d7:04:11:fe:ee:30:15:ba:db:2c:69:4c:d9:c0:cf:46:9f:38:2a:7c:1f:09:d9:a2:5b:5f:f0:b4:f9

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 10, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 16, 2023 - Mar 14, 2024

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:FC41-4BD4-D220,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:b9:f6:00:0d:65:54:4f:bc:03:00:01:00:00:01:b9

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 20, 2022 - Dec 14, 2023

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

5

Entry point

16544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

2026-10-31_a0dcba34777e971c67c32680a92dcf15_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

PE Signature issue

kernel32

advapi32

generic

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-31_a0dcba34777e971c67c32680a92dcf15_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

PE Signature issue

kernel32

advapi32

generic