2026-11-10_d105839deca3c1424384942402035a10_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee

General

Target
2026-11-10_d105839deca3c1424384942402035a10_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee
Size 12.0MB
Sample261111-x2arfsbf49
SHA256 ddebcda545b9e7de0c3e5d6f86e62afe86cfa6facefb9b94362c5ada7d11b937
MD5 d105839deca3c1424384942402035a10
SHA1 9f6744e65cde333cb5beb99eb1b9ddfe47556e8e
SHA512 7d00a63ebe1cec2ae7cd2a0f6f919ca7e5b7357e593f9107d5e9aa06233d84cca8a13285487a9a7a381b7ce9e6c72eb54372972843e586218c84f5e61fb52964
SSDEEP 12288:bYMAs7Fs7Fs7Fs7Fs7Fs7Fs7Fs7Fs7Fs7Fs7Fs7Fs7Fs7Fs7Fs7Fs7Fs7Fs7Fs7G:bY
TLSH
T1E1C629C0E6E1B57DE2B27E30A966DAD34E3BBD92F920D50A3130628E1B735C15F52712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-10_d105839deca3c1424384942402035a10_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee

File Explorer

2026-11-10_d105839deca3c1424384942402035a10_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee

.exe 12.0MB

2026-11-10_d105839deca3c1424384942402035a10_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee

IMPHASH 61ba420b5330c13fb8cfded6ab924182
SHA256 ddebcda545b9e7de0c3e5d6f86e62afe86cfa6facefb9b94362c5ada7d11b937
MD5 d105839deca3c1424384942402035a10
SHA1 9f6744e65cde333cb5beb99eb1b9ddfe47556e8e
SHA512 7d00a63ebe1cec2ae7cd2a0f6f919ca7e5b7357e593f9107d5e9aa06233d84cca8a13285487a9a7a381b7ce9e6c72eb54372972843e586218c84f5e61fb52964
SSDEEP 12288:bYMAs7Fs7Fs7Fs7Fs7Fs7Fs7Fs7Fs7Fs7Fs7Fs7Fs7Fs7Fs7Fs7Fs7Fs7Fs7Fs7G:bY
TLSH
T1E1C629C0E6E1B57DE2B27E30A966DAD34E3BBD92F920D50A3130628E1B735C15F52712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

11088

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\yijodowop\kopo\fosirutobiyum-kebema\yi.pdb

kernel32

VirtualQuery DeleteVolumeMountPointA GlobalAddAtomA GetConsoleAliasA WaitForSingleObject WriteConsoleInputA SetEvent GetConsoleAliasesA GetEnvironmentStrings GetProcessHandleCount GetConsoleAliasW HeapValidate GetLocaleInfoA TerminateProcess FileTimeToSystemTime GetStringTypeExA DeleteFiber GetHandleInformation GetProcAddress VirtualAlloc LoadLibraryA WriteConsoleA LocalAlloc CreateHardLinkW EndUpdateResourceA GetVersionExA EnumCalendarInfoExA GetWriteWatch GetCommandLineA GetStartupInfoA RaiseException RtlUnwind GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc GetLastError HeapFree GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage GetModuleHandleA HeapSize InitializeCriticalSectionAndSpinCount LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW

advapi32

MapGenericMask

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-10_d105839deca3c1424384942402035a10_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee

kernel32

advapi32

generic