2026-10-31_75736a7715cf8051bc89a47b2ac73625_amadey_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-31_75736a7715cf8051bc89a47b2ac73625_amadey_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
Size 392KB
Sample261102-achpfa1v5j
SHA256 af8fa7693e3c127ea6c93678310c5a5e2396b37e1629d9cdfb7fdbfc46de1490
MD5 75736a7715cf8051bc89a47b2ac73625
SHA1 ad70b1bb0ce798072a9bfb0b9783b9aedb023e95
SHA512 064f6328d73bc1119197d22c9be7d82e0f67203cbd8c2638b8a200f0b17dabc6bc56010258b35d0d2cf63af48308e97a3e5244f395c917f45f36f48ca31de31d
SSDEEP 6144:0pGiM7qTOKnLitIz2Twc3hUEjWIB/teWdvTXtzkmIL3E7QPQLEs:0pYiGSzF+7dvRYmIjE77
TLSH
T124847C5133D408F1E8B78A3989768A12DAB63C665B70C7CF23A4661A1F337D09D39B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-31_75736a7715cf8051bc89a47b2ac73625_amadey_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-10-31_75736a7715cf8051bc89a47b2ac73625_amadey_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

.exe 392KB

2026-10-31_75736a7715cf8051bc89a47b2ac73625_amadey_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 7864127ec7bcf8ba38cdcf166115cf8d
SHA256 af8fa7693e3c127ea6c93678310c5a5e2396b37e1629d9cdfb7fdbfc46de1490
MD5 75736a7715cf8051bc89a47b2ac73625
SHA1 ad70b1bb0ce798072a9bfb0b9783b9aedb023e95
SHA512 064f6328d73bc1119197d22c9be7d82e0f67203cbd8c2638b8a200f0b17dabc6bc56010258b35d0d2cf63af48308e97a3e5244f395c917f45f36f48ca31de31d
SSDEEP 6144:0pGiM7qTOKnLitIz2Twc3hUEjWIB/teWdvTXtzkmIL3E7QPQLEs:0pYiGSzF+7dvRYmIjE77
TLSH
T124847C5133D408F1E8B78A3989768A12DAB63C665B70C7CF23A4661A1F337D09D39B17
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

102944

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\re\jdk7u45\229\build\windows-amd64\tmp\deploy\jre-image\bin\javaws.pdb

kernel32

LoadLibraryW GetModuleHandleW FreeLibrary GetProcAddress GetTickCount GetThreadLocale ReadFile CloseHandle WaitForSingleObject SetHandleInformation CreatePipe CreateDirectoryW GetSystemWindowsDirectoryW FindClose FindFirstFileW GetModuleFileNameW GlobalMemoryStatusEx GetVersionExW GetCurrentProcess GetNativeSystemInfo GetLastError CreateFileW GetSystemDirectoryW CreateProcessW lstrlenW LocalAlloc FormatMessageW GetLongPathNameW GetShortPathNameW GetWindowsDirectoryW OutputDebugStringW GetCurrentProcessId GetCurrentThreadId GetModuleHandleExW GetFileAttributesW lstrlenA GetExitCodeProcess WriteConsoleW FlushFileBuffers HeapSize CompareStringW LCMapStringW QueryPerformanceCounter RtlPcToFileHeader GetProcessHeap SetEndOfFile SetFilePointer SetStdHandle GetConsoleMode GetConsoleCP SetHandleCount Sleep SetEnvironmentVariableW SetEnvironmentVariableA DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetEnvironmentStringsW FreeEnvironmentStringsW GetStdHandle WriteFile HeapCreate LocalFree LoadLibraryA RaiseException FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeW FindFirstFileExW WideCharToMultiByte GetSystemTimeAsFileTime HeapFree HeapReAlloc HeapAlloc GetStringTypeW ExitProcess DecodePointer MultiByteToWideChar RtlUnwindEx EnterCriticalSection LeaveCriticalSection DeleteFileW GetFileType RtlLookupFunctionEntry GetDateFormatW GetTimeFormatW GetTimeZoneInformation GetCommandLineW GetStartupInfoW GetFullPathNameW GetFileInformationByHandle PeekNamedPipe GetCurrentDirectoryW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext EncodePointer TerminateProcess GetCPInfo GetACP GetOEMCP IsValidCodePage FlsGetValue FlsSetValue FlsFree SetLastError FlsAlloc HeapSetInformation GetVersion

user32

LoadCursorW DefWindowProcW GetMessageW DispatchMessageW TranslateMessage SetTimer CreateWindowExW RegisterClassW wsprintfW MessageBoxW

ole32

StringFromCLSID CoTaskMemFree

oleaut32

SysFreeString VariantClear SysAllocString SysStringLen SysAllocStringByteLen

wsock32

closesocket WSAAsyncSelect connect htons getsockname ioctlsocket socket bind recv accept ntohs listen WSAStartup send WSAGetLastError

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-31_75736a7715cf8051bc89a47b2ac73625_amadey_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

kernel32

user32

ole32

oleaut32

wsock32

generic