2026-11-03_99082747874223284f2d11bfd064765a_amadey_elex_floxif_redline-stealer_rhadamanthys_smoke-loader

General

Target
2026-11-03_99082747874223284f2d11bfd064765a_amadey_elex_floxif_redline-stealer_rhadamanthys_smoke-loader
Size 165KB
Sample261104-qbhwtade88
SHA256 6d0d68230a34cbeac0e36efdbfcdabf6b0d835ee4bd78dbc8d1437a127e6f815
MD5 99082747874223284f2d11bfd064765a
SHA1 ab60afda843a35adb8313afd690e4c8c30aa7c9e
SHA512 76131d103474a93492f6d86185dadfa45166de8fd88f9c78cc45655c54c9f9a70c302722c1b1f1b82465df7e371c1e806b849cb172d115d54d9eb6951747e61a
SSDEEP 3072:QX6smRqLOUph/Z2lQBV+UdE+rECWp7hK6G:86ijlBV+UdvrEFp7hK6G
TLSH
T136F3BF017281C7FED0102474305DAB105BD6AC3E15EF529BBB52658FAE7C69387AAB0F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-03_99082747874223284f2d11bfd064765a_amadey_elex_floxif_redline-stealer_rhadamanthys_smoke-loader

File Explorer

2026-11-03_99082747874223284f2d11bfd064765a_amadey_elex_floxif_redline-stealer_rhadamanthys_smoke-loader

.exe 165KB

2026-11-03_99082747874223284f2d11bfd064765a_amadey_elex_floxif_redline-stealer_rhadamanthys_smoke-loader

IMPHASH 3d9aac51c16d5bb81bb736f3d49d9286
SHA256 6d0d68230a34cbeac0e36efdbfcdabf6b0d835ee4bd78dbc8d1437a127e6f815
MD5 99082747874223284f2d11bfd064765a
SHA1 ab60afda843a35adb8313afd690e4c8c30aa7c9e
SHA512 76131d103474a93492f6d86185dadfa45166de8fd88f9c78cc45655c54c9f9a70c302722c1b1f1b82465df7e371c1e806b849cb172d115d54d9eb6951747e61a
SSDEEP 3072:QX6smRqLOUph/Z2lQBV+UdE+rECWp7hK6G:86ijlBV+UdvrEFp7hK6G
TLSH
T136F3BF017281C7FED0102474305DAB105BD6AC3E15EF529BBB52658FAE7C69387AAB0F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

5874

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ExitProcess GetFileSize MapViewOfFile UnmapViewOfFile HeapAlloc GetCurrentProcess HeapFree GetProcessHeap Sleep GetModuleFileNameW CreateFileW SetCurrentDirectoryA VirtualAlloc VirtualAllocEx CreateFileMappingW GetModuleFileNameA CloseHandle GetCurrentProcessId LCMapStringW LCMapStringA GetStringTypeW MultiByteToWideChar GetStringTypeA GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW GetProcAddress WriteFile GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId GetLastError InterlockedDecrement HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection LoadLibraryA InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage HeapReAlloc RtlUnwind HeapSize GetLocaleInfoA WideCharToMultiByte

wininet

HttpOpenRequestW HttpSendRequestW InternetConnectW InternetReadFile InternetOpenW HttpQueryInfoW InternetCloseHandle

shlwapi

PathAppendW PathRemoveFileSpecW

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_99082747874223284f2d11bfd064765a_amadey_elex_floxif_redline-stealer_rhadamanthys_smoke-loader

kernel32

wininet

shlwapi

generic