2026-11-05_31713c479ce228a1796e29524fdaa4fd_elex_redline-stealer_remcos_rhadamanthys_sakula_stealc_stop

General

Target
2026-11-05_31713c479ce228a1796e29524fdaa4fd_elex_redline-stealer_remcos_rhadamanthys_sakula_stealc_stop
Size 4.1MB
Sample261107-fs14lsvt9l
SHA256 58bb335d78c01ac03703ffd50226e606ca1996974e3b4a0c4db9d58260dee959
MD5 31713c479ce228a1796e29524fdaa4fd
SHA1 04c44a520664909c4a5133bf0fd2c260e0dd4157
SHA512 4ac4589fa4fc20e56229e44ac4234c37d89ba4186a34ddd16eac567ce0134a6b73c72b01959061831439e5f2b1c189f9e7ef1afdb5342fe8be1c6d665cc39505
SSDEEP 49152:XDVol/H6flWqQsTHqYzcJyDBNCsOLoaYDxUthYSCWMKUXJyWhTv13d9G5t2i+OtN:XDKH2WoxBNl2o9mtdCycXNHU2tOt9v
TLSH
T1011633A071D0C872E1A595345225EBB92D7AB1748D2912CBF7E9AD3CAFB43D0D31930D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-05_31713c479ce228a1796e29524fdaa4fd_elex_redline-stealer_remcos_rhadamanthys_sakula_stealc_stop

File Explorer

2026-11-05_31713c479ce228a1796e29524fdaa4fd_elex_redline-stealer_remcos_rhadamanthys_sakula_stealc_stop

.exe 4.1MB

2026-11-05_31713c479ce228a1796e29524fdaa4fd_elex_redline-stealer_remcos_rhadamanthys_sakula_stealc_stop

IMPHASH c6dd551f3faaabc1b84b7af1e0dd4536
SHA256 58bb335d78c01ac03703ffd50226e606ca1996974e3b4a0c4db9d58260dee959
MD5 31713c479ce228a1796e29524fdaa4fd
SHA1 04c44a520664909c4a5133bf0fd2c260e0dd4157
SHA512 4ac4589fa4fc20e56229e44ac4234c37d89ba4186a34ddd16eac567ce0134a6b73c72b01959061831439e5f2b1c189f9e7ef1afdb5342fe8be1c6d665cc39505
SSDEEP 49152:XDVol/H6flWqQsTHqYzcJyDBNCsOLoaYDxUthYSCWMKUXJyWhTv13d9G5t2i+OtN:XDKH2WoxBNl2o9mtdCycXNHU2tOt9v
TLSH
T1011633A071D0C872E1A595345225EBB92D7AB1748D2912CBF7E9AD3CAFB43D0D31930D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

14781

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetWaitableTimer InterlockedDecrement GetNumberOfConsoleMouseButtons InitializeSListHead CreateJobObjectW CreateDirectoryW UnlockFile GetTimeFormatA ConnectNamedPipe GetTickCount TzSpecificLocalTimeToSystemTime GetSystemPowerStatus SetSystemTimeAdjustment HeapDestroy GetFileAttributesA GetAtomNameW IsDBCSLeadByte ReadFile GetModuleFileNameW GetTimeZoneInformation GetACP RaiseException GetConsoleOutputCP GetHandleInformation GetCurrentDirectoryW GetProcAddress FreeLibrary EnumDateFormatsExA LocalLock EnterCriticalSection PrepareTape GetProcessVersion LocalAlloc SetCalendarInfoW AddVectoredExceptionHandler SetConsoleOutputCP VirtualLock HeapLock SetCommMask GetTapeParameters GetModuleHandleA QueryMemoryResourceNotification FreeEnvironmentStringsW FindAtomW SetFileAttributesW LCMapStringW CompareStringW CompareStringA GetProcessHeap FlushFileBuffers IsValidLocale EnumSystemLocalesA GetConsoleAliasExesLengthA SetEndOfFile SetLocalTime FindVolumeMountPointClose GetConsoleAliasesLengthW GetLastError HeapReAlloc HeapAlloc GetModuleHandleW Sleep ExitProcess GetCommandLineA GetStartupInfoA RtlUnwind TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapFree LeaveCriticalSection DeleteCriticalSection FatalAppExitA HeapCreate VirtualFree VirtualAlloc TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId GetCurrentThread WriteFile GetStdHandle GetModuleFileNameA SetConsoleCtrlHandler InterlockedExchange LoadLibraryA InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer GetConsoleCP GetConsoleMode GetCPInfo GetOEMCP IsValidCodePage MultiByteToWideChar CloseHandle CreateFileA HeapSize GetLocaleInfoW GetLocaleInfoA SetStdHandle WriteConsoleA WriteConsoleW LCMapStringA GetStringTypeA GetStringTypeW GetDateFormatA GetUserDefaultLCID SetEnvironmentVariableA

user32

GetMonitorInfoA GetDesktopWindow GetProcessDefaultLayout GetClassLongA GetUserObjectInformationA

advapi32

ImpersonateAnonymousToken EqualSid RegCreateKeyW SetPrivateObjectSecurity

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-05_31713c479ce228a1796e29524fdaa4fd_elex_redline-stealer_remcos_rhadamanthys_sakula_stealc_stop

kernel32

user32

advapi32

generic