2026-11-07_53837ca6346c507bc31bd67f40c4bc18_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee

General

Target
2026-11-07_53837ca6346c507bc31bd67f40c4bc18_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee
Size 10.7MB
Sample261108-ss2fladt31
SHA256 e25575000c128b85b8e91be4e80397c3e8e6200fdecc25dc079044b33d8ca106
MD5 53837ca6346c507bc31bd67f40c4bc18
SHA1 9148ca3e2bba446c3ce676813adec589b833903c
SHA512 7caf04c66fda899362e364e15799b89ae7d0a519067af75c2c2723f0c9adc8af759dd304a8b110e431640347c0d3485212890b7e226c270f2732da617b9cb589
SSDEEP 3072:mnFGgyg+kSsg+Gl23TCDacD4LFHj92vAqMt4/5fySNSB7mHOHOHOHOHOHOHOHOH/:SPTiaFLFHjFbYOd
TLSH
T18AB62A30DF79A475C82952BCBC2D772966FEC2B0E37663F7342A0FE46849718485660B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-07_53837ca6346c507bc31bd67f40c4bc18_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee

File Explorer

2026-11-07_53837ca6346c507bc31bd67f40c4bc18_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee

.exe 10.7MB

2026-11-07_53837ca6346c507bc31bd67f40c4bc18_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee

IMPHASH d203f3abe5eb4b94121d513952884a24
SHA256 e25575000c128b85b8e91be4e80397c3e8e6200fdecc25dc079044b33d8ca106
MD5 53837ca6346c507bc31bd67f40c4bc18
SHA1 9148ca3e2bba446c3ce676813adec589b833903c
SHA512 7caf04c66fda899362e364e15799b89ae7d0a519067af75c2c2723f0c9adc8af759dd304a8b110e431640347c0d3485212890b7e226c270f2732da617b9cb589
SSDEEP 3072:mnFGgyg+kSsg+Gl23TCDacD4LFHj92vAqMt4/5fySNSB7mHOHOHOHOHOHOHOHOH/:SPTiaFLFHjFbYOd
TLSH
T18AB62A30DF79A475C82952BCBC2D772966FEC2B0E37663F7342A0FE46849718485660B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

67223

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\cubilicoxudu87\yij dejefod.pdb

kernel32

GetUserDefaultLCID ReleaseActCtx GetCPInfoExA WriteConsoleInputA ReadConsoleInputA SetTapeParameters SetTapePosition WriteTapemark GetConsoleAliasesW WriteConsoleA SetLastError BuildCommDCBW WriteProfileSectionW RequestDeviceWakeup LoadLibraryA FlushFileBuffers GetLongPathNameA PulseEvent ProcessIdToSessionId ReadConsoleW ZombifyActCtx GetProcessHeap GetGeoInfoA VirtualProtect GetProcAddress GetModuleHandleW HeapUnlock HeapQueryInformation GetOEMCP WaitForMultipleObjectsEx WaitForSingleObject GetAtomNameA CreateJobObjectW OpenWaitableTimerW HeapValidate WideCharToMultiByte GetConsoleAliasesLengthW GetCommandLineA GetStartupInfoA GetModuleHandleA GetLastError SetFilePointer EnterCriticalSection LeaveCriticalSection TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind HeapAlloc TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement ReadFile Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection HeapCreate VirtualFree HeapFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RaiseException GetCPInfo GetACP IsValidCodePage SetStdHandle GetConsoleCP GetConsoleMode CloseHandle CreateFileA InitializeCriticalSectionAndSpinCount VirtualAlloc HeapReAlloc MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA GetConsoleOutputCP WriteConsoleW SetEndOfFile HeapSize

advapi32

AreAnyAccessesGranted

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-07_53837ca6346c507bc31bd67f40c4bc18_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee

kernel32

advapi32

generic