Extracted

Extracted

• • Target
    2026-11-10_d56e41b5f1a42898b6be927756bf6652_amadey_elex_rhadamanthys_stop
  • Size 355KB
  • SHA256 112e2c174c21b510f96a84192f98474cf83de04920962169e96d3807489bc9b4
  • MD5 d56e41b5f1a42898b6be927756bf6652
  • SHA1 ebdeb7f36a09bc578acf7be402bbda8036e5c1bd
  • SHA512 8b176e046be5f3a90d92e8e2d26027e9b1f64b88ba8580fe49be5a56359b5e891a2f4be27edc097a61c494ce16107e26e9250f82c1865d6b809b9fc9b32178dd
  • SSDEEP 6144:UA21maI7NBIojj+eNddjMh65kD054tNY7ITsqk:p2rInxqyddl5kdk7
  • TLSH
    T1F074E0C27AE1ED32F1A279704C329AB48E7FFA12E660408B37B4276E5F613D05935356
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoor1870590974defense_evasiondiscoveryredlinesmokeloaderinfostealerpersistenceprivilege_escalationtrojan

  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Family: SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • RedLine payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

    defense_evasionprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2