2026-09-26_ab048d44324d72fb8e2075884843c870_amadey_elex_redline-stealer_rhadamanthys_sivis_smoke-loader_stealc_stop
Multi-stage stealer with embedded payloads
Unsigned packed PE launches via ShellExecuteExUnsigned packed PE loads a resource and launches via ShellExecuteEx
SHA-256fcef706f3c818c663a7d70afb7e90ab395175b00b094a8ea66c4bdac99dd6528
Evidence
⋯3 more rows
0x1df000000000000000000000000000000000................
0x1e00bd000000009c58bd0000000089c13500......X.......5.
0x1e10002000509d9c5831c8743eb801000000. .P..X1.t>.....
0x1e200fa289d02500008000742e83cd0289d0....%....t......
⋯7 more rows
⋯3 more rows
0x257e0e8d8405d7feffff80385c7502881856.........8\u...V
0x259e89450c8b45088945e8e8610100008945.E..E..E..a....E
⋯7 more rows
⋯7 more rows
0x704053746174696300004564697400000000Static..Edit....
0x7050427574746f6e000050425f44726f7041Button..PB_DropA
0x7060636365707400000050425f4944000000ccept...PB_ID...
0x707050425f57696e646f7749440057696e64PB_WindowID.Wind
0x70806f77436c6173735f2564000050425f4dowClass_%d..PB_M
0x709044495f4761646765740000004d44495fDI_Gadget...MDI_
0x70a04368696c64436c617373000052696368ChildClass..Rich
⋯7 more rows
⋯7 more rows
0x87f000000000000000000000000000000000................
0x880000000000000000000400000000000400................
0x881003000000300000800a00000070000080....0.......p...
0x88200e0000007001008018000000b0010080....p...........
0x883000000000000000000400000000000100................
0x884001000000480000800000000000000000....H...........
0x885004000000000001000000000060000000............`...
0x886004c2000068030000e404000000000000....h...........
0x887000000000000000000400000005000000................
0x8880f0010080a8000080f4010080d0000080................
0x8890f8010080f8000080fc01008020010080............ ...
0x88a000020080480100800000000000000000....H...........
0x88b0040000000000010000000000c0000000................
0x88c06cc5000038010000e404000000000000l...8...........
0x88d000000000000000000400000000000100................
0x88e000000000e8000000a4c60000c0f65801..............X.
0x88f0e4040000000000000000000000000000................
0x890004000000000001000000000010010000................
0x891064bd59014c000000e404000000000000d.Y.L...........
0x892000000000000000000400000000000100................
0x89300000000038010000b0bd59010b000000....8.....Y.....
0x8940e4040000000000000000000000000000................
0x895004000000000001000000000060010000............`...
0x8960bcbd590106000000e404000000000000..Y.............
0x897000000000000000000400000000000100................
0x898001000000880100800000000000000000................
0x8990040000000000010000000000a0010000................
0x89a0c4bd590114000000e404000000000000..Y.............
0x89b000000000000000000400000000000100................
0x89c001000000c80100800000000000000000................
0x89d0040000000000010000000000e0010000................
0x89e0d8bd590163020000e404000000000000..Y.c...........
0x89f001004200010046000100490001004e00..B...F...I...N.
0x8a0001004f00280000001000000020000000..O.(....... ...
0x8a1001001800000000000003000000000000................
0x8a2000000000000000000000000081620783.............b..
0x8a30640780650b83640982650a8168088866d..e..d..e..h..f
0x8a400d85680d87680b88690e8b690f876a0f..h..h..i..i..j.
0x8a508b6c0f8c6e0f8b6c118d6c0f83640785.l..n..l..l..d..
0x8a60630a81630a84640b86650882670d8769c..c..d..e..g..i
0x8a700a85670e86690e876b0d8a6b0e8a6b0e..g..i..k..k..k.
0x40a64cb3b15e660408b7f331b61a3180e327d9..^f....1..1..'.
0x40a65c7e3ac8e475d054c0b0e1acfcc8e6ddca~:..u.T.........
0x40a66cacb6f47262b5cdf875f00730bd890887...rb...u..0....
0x40a67c7e17b07aa5d7c2a10fded28f907aff71~..z.........z.q
0x40a68cc06df83af1805b94d03360978bfbe3d8.m.:..[..3`.....
0x40a69ca54f2460177bcd5cb47f7dacfd0bb8fd.O$`.{.\..}.....
0x40a6ac0c956b375d7d028484faca4f4f247ee5..k7]}.....OO$~.
0x40a6cce24dbdf6bf8da8b47bbf599dd9fb8b6f.M......{.Y....o
0x40a6dc5067baca2c7526e333a5d2bcebef8691Pg..,u&.3.......
0x40a6ec2805770cb08a335b8d249859f31ec630(.w...3[.$.Y...0
0x40a6fceb9835861f6efbdf1ec3b6926f1ec365..5..n......o..e
0x40a70ca78f81e3da2d293b4d27fbda278611f5.....-);M'..'...
0x40a71c36f3de2d6de198166d7a692b073f6f466..-m...mzi+.?oF
0x40a72cf0f314f9cce74c8c06380bbbf3e52436......L..8....$6
0x40a73cfb39e704e2c237f3a7d6d362a1415f72.9....7....b.A_r
0x40a74c6cb899e8e39f18745e8f35e8efaefc6fl......t^.5....o
0x40a75c6b60f4a9c435f0458f825c7acdb83035k`...5.E..\z..05
0x40a76c92126be4ef2bfa0d51ea701d36e90fc2..k..+..Q.p.6...
0x40a77c2c66038fb1c51c1a8856758d547815fd,f.......Vu.Tx..
0x40a78c723f03cb192d5fd1120833299b081501r?...-_...3)....
0x40a79c115de95edeb9f607348cf35b69be164b.].^....4..[i..K
0x40a7ace7bbd8659b22e9d78ac59d11fbd5ba4f...e.".........O
0x40a7bceac488b89f81b24b43c082cfceec373a.......KC.....7:
0x40a7cc1c0be8d7c3f48b3a7a550f8fd65cacb7.......:zU...\..
0x40a7dcd65c85eebed33d9cad583f46688e46f7.\....=..X?Fh.F.
0x40a7ec76c6041384e0c97508c1d39b6797e351v......u....g..Q
0x40a7fcd941dc2ad82d534d9937d950ca63df16.A.*.-SM.7.P.c..
0x40a80cf95046a2e275e22656bc6e911bc72428.PF..u.&V.n...$(
0x40a81c5e9b58f13ae2c523867bfb4ae6da8626^.X.:..#.{.J...&
0x40a82c598d45733399413675aa6cba93972544Y.Es3.A6u.l...%D
0x40a83c197f0e0b0e2a569f54ecf2c2c8e22da6.....*V.T.....-.
0x40a84c0698789324e85a8d50133ef85dfaa060..x.$.Z.P.>.]..`
0x40a85c7dad98abe5cc5d25d696e4ac2d76ed85}.....]%....-v..
0x40a86cfac255e78f70837a69a734e6b386f2c7..U..p.zi.4.....
0x40a87c228c12e2aee17a26d5a72aebee7788c2".....z&..*..w..
0x40a88c929cc2e28e6bc3b54ab5e1f0f4ddff03.....k..J.......
0x40a89cd1dce1f6f4adfd5e02137ca11e63828f.......^..|..c..
0x40a8ac7c3fae7eb0a6553c890611faac53841a|?.~..U<.....S..
0x40a8bc8945d753f542bb3a17b6c8df39e1a9d6.E.S.B.:....9...
0x40a8ccbe1986adc6fde03e71cc6a1e0506f7b6.......>q.j.....
0x40a8dc3c301017c94e279d8b34099f7c72c4b0<0...N'..4..|r..
0x40a8ec74ca0102c14265189f1df135b032fd9at....Be....5.2..
0x40a8fcfa6e53852cd6a12a6d2502f95926681c.nS.,..*m%..Y&h.
0x40a90ca3e12ad7181cbe84fa30d7de7e0f3298..*......0..~.2.
0x40a91c148fd166b98bb343330472c023751f11...f...C3.r.#u..
0x40a92ce1ea13ccae8a058b8886a3b6523ec879............R>.y
0x40a93c0f9b0df9adda08f6341ded6fc6664cb1........4..o.fL.