2026-11-13_c1e3ed33a56e84d702b7ad77296ae872_amadey_elex_mafia_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop

General

Target
2026-11-13_c1e3ed33a56e84d702b7ad77296ae872_amadey_elex_mafia_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop
Size 664KB
Sample261113-3pp89sts2j
SHA256 d1d7f2aaa6be4ebd688b56325e480018945d23fafcfabde5f6c82a324dee9697
MD5 c1e3ed33a56e84d702b7ad77296ae872
SHA1 bfe3d6e9848c0a32aefc8f103c5e18b7a70898e5
SHA512 95c2795df273ab1c21f59fa9e411e541e93518217ccf34f7a2acd5a74e5ff123c53c78d926def5302722ca9ddce5d8f7ddbd316dc19cbb6b1a8e478dce51e957
SSDEEP 12288:4BpK5jOAVuJ5PIGww7F5DO3HYffxBpK51BpK5k:YK54lIYF5SXYH9OR
TLSH
T1FFE4BF21B687C0B2E41225744462C7324B26BE3217A796C77BE57A7F6E352C1C73A31E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-13_c1e3ed33a56e84d702b7ad77296ae872_amadey_elex_mafia_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop

File Explorer

2026-11-13_c1e3ed33a56e84d702b7ad77296ae872_amadey_elex_mafia_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop

.exe 664KB

2026-11-13_c1e3ed33a56e84d702b7ad77296ae872_amadey_elex_mafia_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop

IMPHASH 3d9aac51c16d5bb81bb736f3d49d9286
SHA256 d1d7f2aaa6be4ebd688b56325e480018945d23fafcfabde5f6c82a324dee9697
MD5 c1e3ed33a56e84d702b7ad77296ae872
SHA1 bfe3d6e9848c0a32aefc8f103c5e18b7a70898e5
SHA512 95c2795df273ab1c21f59fa9e411e541e93518217ccf34f7a2acd5a74e5ff123c53c78d926def5302722ca9ddce5d8f7ddbd316dc19cbb6b1a8e478dce51e957
SSDEEP 12288:4BpK5jOAVuJ5PIGww7F5DO3HYffxBpK51BpK5k:YK54lIYF5SXYH9OR
TLSH
T1FFE4BF21B687C0B2E41225744462C7324B26BE3217A796C77BE57A7F6E352C1C73A31E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

5874

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ExitProcess GetFileSize MapViewOfFile UnmapViewOfFile HeapAlloc GetCurrentProcess HeapFree GetProcessHeap Sleep GetModuleFileNameW CreateFileW SetCurrentDirectoryA VirtualAlloc VirtualAllocEx CreateFileMappingW GetModuleFileNameA CloseHandle GetCurrentProcessId LCMapStringW LCMapStringA GetStringTypeW MultiByteToWideChar GetStringTypeA GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW GetProcAddress WriteFile GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId GetLastError InterlockedDecrement HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection LoadLibraryA InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage HeapReAlloc RtlUnwind HeapSize GetLocaleInfoA WideCharToMultiByte

wininet

HttpOpenRequestW HttpSendRequestW InternetConnectW InternetReadFile InternetOpenW HttpQueryInfoW InternetCloseHandle

shlwapi

PathAppendW PathRemoveFileSpecW

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-13_c1e3ed33a56e84d702b7ad77296ae872_amadey_elex_mafia_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop

kernel32

wininet

shlwapi

generic