2026-11-01_940395c1b8fe8bcf179596d1340570bd_elex_redline-stealer_rhadamanthys_stop_tofsee

General

Target
2026-11-01_940395c1b8fe8bcf179596d1340570bd_elex_redline-stealer_rhadamanthys_stop_tofsee
Size 279KB
Sample261102-rx8j2acy7p
SHA256 71ad05138cb03dd69322d141efa3d4c93f4f3042c08a2e10fe96e39a5ed826f5
MD5 940395c1b8fe8bcf179596d1340570bd
SHA1 9992b3109a60ea7441cd2702f8573258c6d844a8
SHA512 7e5a5de12bad1a12233fe8b306feb27782e3bcd165486d7c07101e2f940f28726e1ef4227d1e3d4e9e3a2c9f6b153718cf9558017967553f52f43a5de30e3758
SSDEEP 6144:9FFHyfP0tOhdD3TBlUPFK4gXkirxbrZ7/:xSfdD3T3kK4sRx1/
TLSH
T16754CF127BC1C4B3C42650358866CB756B39BD2207648AE7F3587B7E5E313D1AA3638A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_940395c1b8fe8bcf179596d1340570bd_elex_redline-stealer_rhadamanthys_stop_tofsee

File Explorer

2026-11-01_940395c1b8fe8bcf179596d1340570bd_elex_redline-stealer_rhadamanthys_stop_tofsee

.exe 279KB

2026-11-01_940395c1b8fe8bcf179596d1340570bd_elex_redline-stealer_rhadamanthys_stop_tofsee

IMPHASH 342ee17dce8c5635edd05728f51e3053
SHA256 71ad05138cb03dd69322d141efa3d4c93f4f3042c08a2e10fe96e39a5ed826f5
MD5 940395c1b8fe8bcf179596d1340570bd
SHA1 9992b3109a60ea7441cd2702f8573258c6d844a8
SHA512 7e5a5de12bad1a12233fe8b306feb27782e3bcd165486d7c07101e2f940f28726e1ef4227d1e3d4e9e3a2c9f6b153718cf9558017967553f52f43a5de30e3758
SSDEEP 6144:9FFHyfP0tOhdD3TBlUPFK4gXkirxbrZ7/:xSfdD3T3kK4sRx1/
TLSH
T16754CF127BC1C4B3C42650358866CB756B39BD2207648AE7F3587B7E5E313D1AA3638A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

62187

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WaitForSingleObject GetSystemWindowsDirectoryA CreateProcessA GetVolumePathNamesForVolumeNameA GetModuleFileNameA FindFirstVolumeA GetTempPathA FindNextVolumeA FindVolumeClose VirtualFree FlushFileBuffers VirtualAlloc DeleteFileA GetSystemTime CloseHandle GetVersionExA LoadLibraryA FindClose GetTempFileNameA CopyFileA RemoveDirectoryA GetProcAddress GetLastError FindFirstFileA CreateDirectoryA MultiByteToWideChar ReadFile Sleep WriteFile GetTickCount GetCurrentProcess FreeLibrary SetEndOfFile MoveFileExA GetFileSize SetFilePointer CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle HeapSize InitializeCriticalSectionAndSpinCount GetConsoleMode GetConsoleCP GetLocaleInfoA GetStringTypeW GetStringTypeA GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStdHandle ExitProcess HeapReAlloc EnterCriticalSection LeaveCriticalSection DeleteCriticalSection HeapFree HeapAlloc TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA GetStartupInfoA RaiseException RtlUnwind GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId LCMapStringA WideCharToMultiByte LCMapStringW HeapCreate

user32

MessageBoxA

advapi32

FreeSid OpenSCManagerA AllocateAndInitializeSid RegCreateKeyExA EqualSid RegSetValueExA GetTokenInformation OpenProcessToken CloseServiceHandle RegCloseKey

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_940395c1b8fe8bcf179596d1340570bd_elex_redline-stealer_rhadamanthys_stop_tofsee

kernel32

user32

advapi32

generic