2026-11-01_b8eea750287af276149532881f2ca63b_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

General

Target
2026-11-01_b8eea750287af276149532881f2ca63b_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
Size 798KB
Sample261102-mp3llabs7k
SHA256 de056473c762bd2d7236eb348b8c87a7c0725242b2b8cf552716dd6b33e99faf
MD5 b8eea750287af276149532881f2ca63b
SHA1 8b95a0da2b158b7d26ace84f259f0daec7dd2985
SHA512 4e7808705ac8cf9e706ad2442c6681425e834577d4c3077edcddc956770d3d7e527b173a193a39b1a72d7348ebd63b5592fed61a6bd1374ba8605784674a3ac9
SSDEEP 12288:/Bz4BVxpRs1rAtbohIqTNVzkKCYGrYeGpIXKM:tWLs4EhISNur7G4
TLSH
T1E405A41263E54128F2F33A70697857300B7B7CA1AA3EC19F5288519D5EF2EC0AD357A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_b8eea750287af276149532881f2ca63b_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

File Explorer

2026-11-01_b8eea750287af276149532881f2ca63b_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

.sys 798KB

2026-11-01_b8eea750287af276149532881f2ca63b_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

IMPHASH b563ec92fa8dbb452c28ef0471322a8b
SHA256 de056473c762bd2d7236eb348b8c87a7c0725242b2b8cf552716dd6b33e99faf
MD5 b8eea750287af276149532881f2ca63b
SHA1 8b95a0da2b158b7d26ace84f259f0daec7dd2985
SHA512 4e7808705ac8cf9e706ad2442c6681425e834577d4c3077edcddc956770d3d7e527b173a193a39b1a72d7348ebd63b5592fed61a6bd1374ba8605784674a3ac9
SSDEEP 12288:/Bz4BVxpRs1rAtbohIqTNVzkKCYGrYeGpIXKM:tWLs4EhISNur7G4
TLSH
T1E405A41263E54128F2F33A70697857300B7B7CA1AA3EC19F5288519D5EF2EC0AD357A7
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

679936

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

autochk.pdb

ntdll

_wcsicmp wcsstr NtClose NtQueryValueKey NtOpenKey RtlInitUnicodeString NtQuerySymbolicLinkObject NtOpenSymbolicLinkObject RtlPrefixUnicodeString RtlEqualUnicodeString NtQueryDirectoryObject NtOpenDirectoryObject NtFsControlFile NtOpenFile memset NtSerializeBoot LdrSetMUICacheType NtTerminateProcess RtlUnhandledExceptionFilter RtlUnwind RtlFreeAnsiString RtlAllocateHeap isspace RtlUnicodeStringToAnsiString RtlNormalizeProcessParams _vsnwprintf NtDelayExecution isprint memcpy NtDeviceIoControlFile _allmul _alldiv NtCreateFile RtlRaiseStatus NtReadFile NtWriteFile NtQueryVolumeInformationFile memmove NtQueryInformationFile _chkstk wcsspn _vsnprintf RtlOemToUnicodeN RtlMultiByteToUnicodeN RtlUnicodeToOemN RtlUnicodeToMultiByteN _wcsupr _wcslwr wcschr _wtoi64 _wtol _allshl _aulldiv RtlFreeUnicodeString RtlDosPathNameToNtPathName_U NtShutdownSystem NtAdjustPrivilegesToken NtOpenProcessToken NtQuerySystemTime NtQuerySystemInformation NtSetInformationFile RtlValidRelativeSecurityDescriptor RtlTimeToTimeFields RtlExpandEnvironmentStrings_U NtSetThreadExecutionState RtlRandomEx RtlFreeHeap RtlSizeHeap qsort NtDisplayString NtWaitForMultipleObjects NtCreateEvent swprintf_s RtlFormatMessage RtlAnsiStringToUnicodeString RtlInitAnsiStringEx RtlFindMessage wcsncmp RtlQueryRegistryValues RtlWriteRegistryValue NtQueryPerformanceCounter RtlSubAuthoritySid RtlInitializeSid RtlLengthRequiredSid RtlAddAce RtlCopySid RtlLengthSid RtlQueryInformationAcl RtlCreateAcl RtlAddAccessAllowedAce RtlVerifyVersionInfo VerSetConditionMask RtlLengthSecurityDescriptor RtlValidSecurityDescriptor RtlNewSecurityObject RtlSetDaclSecurityDescriptor RtlSetGroupSecurityDescriptor RtlCreateSecurityDescriptor RtlSystemTimeToLocalTime _allrem RtlDecompressBuffer RtlUpcaseUnicodeString RtlComputeCrc32 DbgPrint RtlDeleteElementGenericTable RtlFindSetBits RtlClearBits RtlInitializeBitMap RtlLookupElementGenericTable RtlNumberOfSetBits RtlEnumerateGenericTableWithoutSplaying RtlSetBits RtlInsertElementGenericTable RtlInitializeGenericTable DbgPrintEx

Name

.text

Size

407KB

Virtual Size

407KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

224KB

Virtual Size

223KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

pnsg

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

141KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_b8eea750287af276149532881f2ca63b_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop

ntdll

generic