2026-10-30_2e18e3db4c04a30f6f5678d76ee7349e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

General

Target
2026-10-30_2e18e3db4c04a30f6f5678d76ee7349e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 10.8MB
Sample261101-e6shystx6q
SHA256 37c450b50166b6e9d0a7146ad0974aaee168ac1375e647ae91c00c565d085cf7
MD5 2e18e3db4c04a30f6f5678d76ee7349e
SHA1 6d0deeb86d53b5a2140c01f8779162e9e80af4ef
SHA512 6ab041da56f97e3ebf48a703a4f523245080465889ecfd075088298e2ca50e962e17b71b599572d1a622a3c633c8a3e1a4a7d676c3b968a5d19b83b601317a1d
SSDEEP 49152:K2bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbj:K
TLSH
T10EB66D9853A155A6DFE213F63F7E0B872DABF8CA512E46FE1C2E1E412D413005D8277A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-30_2e18e3db4c04a30f6f5678d76ee7349e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-10-30_2e18e3db4c04a30f6f5678d76ee7349e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 10.8MB

2026-10-30_2e18e3db4c04a30f6f5678d76ee7349e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH 3d7c45e24146403a838d1d0b0c6dc154
SHA256 37c450b50166b6e9d0a7146ad0974aaee168ac1375e647ae91c00c565d085cf7
MD5 2e18e3db4c04a30f6f5678d76ee7349e
SHA1 6d0deeb86d53b5a2140c01f8779162e9e80af4ef
SHA512 6ab041da56f97e3ebf48a703a4f523245080465889ecfd075088298e2ca50e962e17b71b599572d1a622a3c633c8a3e1a4a7d676c3b968a5d19b83b601317a1d
SSDEEP 49152:K2bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbj:K
TLSH
T10EB66D9853A155A6DFE213F63F7E0B872DABF8CA512E46FE1C2E1E412D413005D8277A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

5509

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ExitProcess GetThreadContext GlobalMemoryStatus SetFilePointer WritePrivateProfileStructA TlsGetValue SetLocalTime LoadResource GetNamedPipeHandleStateA GetProfileSectionA CancelWaitableTimer SetComputerNameW GetComputerNameW FreeEnvironmentStringsA _lclose SetTapeParameters GetModuleHandleW GetProcessHeap GetSystemTimeAsFileTime SetProcessPriorityBoost FindResourceExA GlobalAlloc GetPrivateProfileIntA LocalShrink GetConsoleMode CopyFileW GetPrivateProfileStructW VerifyVersionInfoA lstrcatA GetBinaryTypeW GetACP ExitThread lstrlenW VirtualUnlock RaiseException DeactivateActCtx ReleaseActCtx GetLastError IsDBCSLeadByteEx GetProcAddress IsValidCodePage LoadLibraryA CreateSemaphoreW UnhandledExceptionFilter BuildCommDCBAndTimeoutsW AddAtomW GetProfileStringA SetFileApisToANSI GetSystemInfo SetEnvironmentVariableA SetConsoleCursorInfo WaitCommEvent ContinueDebugEvent GetCurrentDirectoryA CompareStringA CloseHandle FindActCtxSectionStringW GetSystemTime lstrcpyA CompareStringW GetModuleHandleA HeapAlloc GetCommandLineA GetStartupInfoA DeleteCriticalSection LeaveCriticalSection FatalAppExitA EnterCriticalSection HeapFree VirtualFree VirtualAlloc HeapReAlloc HeapCreate HeapDestroy Sleep WriteFile GetStdHandle GetModuleFileNameA SetUnhandledExceptionFilter GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCurrentThread QueryPerformanceCounter GetTickCount GetCurrentProcessId InitializeCriticalSectionAndSpinCount TerminateProcess GetCurrentProcess IsDebuggerPresent RtlUnwind SetConsoleCtrlHandler FreeLibrary InterlockedExchange GetCPInfo GetOEMCP HeapSize GetLocaleInfoW GetLocaleInfoA LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetTimeFormatA GetDateFormatA GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetTimeZoneInformation

user32

GetCursorPos

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-30_2e18e3db4c04a30f6f5678d76ee7349e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

kernel32

user32

generic