2026-09-29_f6c665216e563deb5ad87ac0e9caae38_amadey_elex_rhadamanthys_stealc_stop
Amadey stealer masquerading as Adobe
Keyboard hook starts a hidden-window threadExecutable PE resource section
SHA-256db6973a8eabf340ddd41f78e52b4ba4f087e9a94f9e5aba9613c959cb74bc8da
Evidence
⋯7 more rows
0x2ad5c8b459850ff152c9043006a006a006a00.E.P..,.C.j.j.j.
0x2ad6c6800000008ff1578934300837de80074h......x.C..}..t
0x2ad7c0a8b4de851ff15a89243008a55f38855..M.Q....C..U..U
⋯15 more rows
0x38fac69006e006c00000043576e6400000000i.n.l...CWnd....
0x38fbc00000000ffffffff4100660078005700........A.f.x.W.
0x38fcc6e006400390030007300750000000000n.d.9.0.s.u.....
0x38fdc41006600780043006f006e0074007200A.f.x.C.o.n.t.r.
0x38fec6f006c00420061007200390030007300o.l.B.a.r.9.0.s.
0x38ffc750000004100660078004d0044004900u...A.f.x.M.D.I.
0x3900c4600720061006d006500390030007300F.r.a.m.e.9.0.s.
0x3901c75000000410066007800460072006100u...A.f.x.F.r.a.
0x3902c6d0065004f0072005600690065007700m.e.O.r.V.i.e.w.
0x3903c390030007300750000000000410066009.0.s.u.....A.f.
0x3904c78004f006c00650043006f006e007400x.O.l.e.C.o.n.t.
0x3905c72006f006c0039003000730075000000r.o.l.9.0.s.u...
0x3906c4100660078004f006c00640057006e00A.f.x.O.l.d.W.n.
0x3907c6400500072006f006300340032003300d.P.r.o.c.4.2.3.
0x3908c0000000094b04300bca54300b4a54300......C...C...C.
0x3909c54000000ffff000090074100c8b04300T.........A...C.
0x390ac00000000000000004765744d6f6e6974........GetMonit
0x390bc6f72496e666f41004765744d6f6e6974orInfoA.GetMonit
0x390cc6f72496e666f5700456e756d44697370orInfoW.EnumDisp
0x390dc6c6179446576696365735700456e756dlayDevicesW.Enum
0x390ec446973706c61794d6f6e69746f727300DisplayMonitors.
0x390fc4d6f6e69746f7246726f6d506f696e74MonitorFromPoint
0x3910c000000004d6f6e69746f7246726f6d52....MonitorFromR
0x3911c656374004d6f6e69746f7246726f6d57ect.MonitorFromW
0x3912c696e646f770000004765745379737465indow...GetSyste
0x3913c6d4d6574726963730000000055005300mMetrics....U.S.
0x3914c45005200330032000000000044495350E.R.3.2.....DISP
0x3915c4c415900610063006300500061007200LAY.a.c.c.P.a.r.
0x3916c65006e00740000006100630063004300e.n.t...a.c.c.C.
0x3917c680069006c00640043006f0075006e00h.i.l.d.C.o.u.n.
0x3918c74000000610063006300430068006900t...a.c.c.C.h.i.
0x3919c6c006400000000006100630063004e00l.d.....a.c.c.N.
0x391ac61006d00650000006100630063005600a.m.e...a.c.c.V.
0x391bc61006c00750065000000000061006300a.l.u.e.....a.c.
0x391cc63004400650073006300720069007000c.D.e.s.c.r.i.p.
0x391dc740069006f006e000000000061006300t.i.o.n.....a.c.
0x391ec630052006f006c006500000061006300c.R.o.l.e...a.c.
0x391fc63005300740061007400650000000000c.S.t.a.t.e.....
0x3920c610063006300480065006c0070000000a.c.c.H.e.l.p...
0x3921c610063006300480065006c0070005400a.c.c.H.e.l.p.T.
0x3922c6f007000690063000000000061006300o.p.i.c.....a.c.
0x3923c63004b006500790062006f0061007200c.K.e.y.b.o.a.r.
0x3924c6400530068006f007200740063007500d.S.h.o.r.t.c.u.
0x3925c7400000061006300630046006f006300t...a.c.c.F.o.c.
0x3926c75007300000000006100630063005300u.s.....a.c.c.S.
0x3927c65006c0065006300740069006f006e00e.l.e.c.t.i.o.n.
0x3928c00000000610063006300440065006600....a.c.c.D.e.f.
0x3929c610075006c0074004100630074006900a.u.l.t.A.c.t.i.
⋯5 more rows
0x3e2ec5f004500720072006f00720000000000_.E.r.r.o.r.....
0x3e2fc5300680065006c006c00450078006500S.h.e.l.l.E.x.e.
0x3e30c63007500740065002000730075006300c.u.t.e. .s.u.c.
⋯11 more rows
⋯3 more rows
0x499f000000000000000000000000000000000................
0x49a0000000000000000000400000000000400................
0x49a1003000000300000800e00000078000080....0.......x...
0x49a20100000009000008018000000a8000080................
0x49a3000000000000000000400000000000700................
⋯7 more rows
⋯5 more rows
0x53df05850414444494e4750414444494e4758XPADDINGPADDINGX
0x53e00001000008800000036313d3160316431........61=1`1d1
0x53e1068316c310632e032fa3215339933d633h1l1.2.2.2.3.3.3
0x53e2077359d35eb3720387c38e538f6380339w5.5.7 8|8.8.8.9
0x53e301b39203937394b395f39733987399b39.9 979K9_9s9.9.9
⋯11 more rows