General
- Target 2026-04-16_1603776a018ac5601764bee02d3044be_elex_rhadamanthys_stealc_stop
- Size 525KB
- Sample260416-dmcsqaex2r
- SHA256 8010f95d4cdc4a439c8db9519e388fce6f72f80ee661e7f21788cfd4cb5f4072
- MD5 1603776a018ac5601764bee02d3044be
- SHA1 4c3ce7f4ec8b94cf02c658dd919e890eaf7dcaee
- SHA512 63adadb61b3a392feef6e60e53856ee98ad71896fa1b22dc703dfbd24afb518a2d9b6ae838fd875ec27c9f1c7c57fa854a6cace21d5c3be49fae7466741961e0
- SSDEEP 6144:Y2KW7lwFXUEeJi2xVCVxfwY+0QSyvmZ3INALzTuFjSMg4ONgOZLOMZDOP2jqAig1:YwGtVfjTQSaoINAHTusMgDND4oqnDo
- TLSH T14DB4BF103790C475E36627310896E6F009B9BC385AA5D68FF7A47E3A5E312938A7734F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-04-16_1603776a018ac5601764bee02d3044be_elex_rhadamanthys_stealc_stop.exe
Resource
win10v2004-20260130-en
7 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.226
-
218.54.31.165
Targets
-
- Target 2026-04-16_1603776a018ac5601764bee02d3044be_elex_rhadamanthys_stealc_stop
- Size 525KB
- SHA256 8010f95d4cdc4a439c8db9519e388fce6f72f80ee661e7f21788cfd4cb5f4072
- MD5 1603776a018ac5601764bee02d3044be
- SHA1 4c3ce7f4ec8b94cf02c658dd919e890eaf7dcaee
- SHA512 63adadb61b3a392feef6e60e53856ee98ad71896fa1b22dc703dfbd24afb518a2d9b6ae838fd875ec27c9f1c7c57fa854a6cace21d5c3be49fae7466741961e0
- SSDEEP 6144:Y2KW7lwFXUEeJi2xVCVxfwY+0QSyvmZ3INALzTuFjSMg4ONgOZLOMZDOP2jqAig1:YwGtVfjTQSaoINAHTusMgDND4oqnDo
- TLSH T14DB4BF103790C475E36627310896E6F009B9BC385AA5D68FF7A47E3A5E312938A7734F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE