2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop

General

Target
2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop
Size 665KB
Sample261104-x3bedaee56
SHA256 728bd47971bb954e853648ba0ec9389d6247266acddf7f93d03a89ec5ee075f2
MD5 5e58b98a1cf3eb1655f9fbf7a539da01
SHA1 4e9a04457099a0ec1612e8cad6ce11956435c712
SHA512 0a8e118f848841595b5773a0582431f0dd169880b8057d791fa1bab8c6ce6b787169f2d96dcc2dbb2bf9a9a034b3a020f8de57de76c6d81944fb0d4a3aa32eab
SSDEEP 12288:sWkCC5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:sGC5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T149E4124C3960D477C50907B346B6D9A88A0EAC626E24549BFBDC374ABF33DFE4636016
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop

File Explorer

2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop

.exe 665KB

2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop

IMPHASH a483ddc37adfa3e1d676a2c4ca772dc1
SHA256 728bd47971bb954e853648ba0ec9389d6247266acddf7f93d03a89ec5ee075f2
MD5 5e58b98a1cf3eb1655f9fbf7a539da01
SHA1 4e9a04457099a0ec1612e8cad6ce11956435c712
SHA512 0a8e118f848841595b5773a0582431f0dd169880b8057d791fa1bab8c6ce6b787169f2d96dcc2dbb2bf9a9a034b3a020f8de57de76c6d81944fb0d4a3aa32eab
SSDEEP 12288:sWkCC5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:sGC5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T149E4124C3960D477C50907B346B6D9A88A0EAC626E24549BFBDC374ABF33DFE4636016
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

15594

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

z:\BkavBluPro\bLiveUpdate\Release\BLuPro.pdb

kernel32

DisconnectNamedPipe FlushFileBuffers GetExitCodeThread TlsAlloc CreateEventA SetEvent TlsSetValue TlsGetValue SetNamedPipeHandleState WaitNamedPipeA CreateFileA GetCurrentProcessId TlsFree ReadFile WriteFile CopyFileA GetFileAttributesA SetFileAttributesA CreateDirectoryA GetCurrentThread SetFilePointer WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle InitializeCriticalSectionAndSpinCount VirtualAlloc HeapReAlloc GetLocaleInfoA GetCurrentThreadId DuplicateHandle WaitForSingleObject CloseHandle GetCurrentProcess WideCharToMultiByte CreateMutexA GetLastError lstrlenA ExpandEnvironmentStringsA GetSystemDirectoryA Sleep CreateThread GetCommandLineA ExitProcess LoadLibraryA LoadLibraryExA GetProcAddress GetModuleHandleA FreeLibrary GetStartupInfoA GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetModuleHandleW SetLastError TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind HeapSize HeapAlloc RaiseException HeapFree EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle GetFileType DeleteCriticalSection GetConsoleCP GetConsoleMode MultiByteToWideChar GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

user32

SendMessageA LoadImageA LoadCursorA RegisterClassExA CreateWindowExA ShowWindow UpdateWindow GetMessageA TranslateMessage DispatchMessageA BeginPaint EndPaint PostQuitMessage DestroyWindow DefWindowProcA MessageBoxA FindWindowA

gdi32

TextOutA

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey RegSetValueExA

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop

kernel32

user32

gdi32

advapi32

generic