General
- Target 2026-04-15_f848197ba7ddd852d579587daaf535f1_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 593KB
- Sample260415-psvq9set4n
- SHA256 358b4ef12bb2429e314eccee0959bfb710746c5c5bc55879a43d260512d2b6d1
- MD5 f848197ba7ddd852d579587daaf535f1
- SHA1 f227fc4a664674a2edcb64f776b65fb54c035195
- SHA512 f8fe032fd1d81ee36a7e772d610ee433f8e6189097372b31903d192237d98c5ffe317558d075707c567850a1f4c9392b9b35905ed0c8db4191bf80fec70e284f
- SSDEEP 6144:8EK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdFJ:8MpASIcWYx2U6hAJQnO
- TLSH T106D494685828C8D6E795D534E82CEB1596F48CF17B8300ABB076F9FCD4B22D161AF50E
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-04-15_f848197ba7ddd852d579587daaf535f1_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260130-en
7 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-04-15_f848197ba7ddd852d579587daaf535f1_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 593KB
- SHA256 358b4ef12bb2429e314eccee0959bfb710746c5c5bc55879a43d260512d2b6d1
- MD5 f848197ba7ddd852d579587daaf535f1
- SHA1 f227fc4a664674a2edcb64f776b65fb54c035195
- SHA512 f8fe032fd1d81ee36a7e772d610ee433f8e6189097372b31903d192237d98c5ffe317558d075707c567850a1f4c9392b9b35905ed0c8db4191bf80fec70e284f
- SSDEEP 6144:8EK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdFJ:8MpASIcWYx2U6hAJQnO
- TLSH T106D494685828C8D6E795D534E82CEB1596F48CF17B8300ABB076F9FCD4B22D161AF50E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE