General
- Target 2026-04-23_0f612c679b6bdb16cf202b82bb43280c_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 594KB
- Sample260423-a6767ae16t
- SHA256 0ce9a1a21b9b69fb0baf778b7f199ee0c769e07ce5d0a8a3b1eaf3120f816afc
- MD5 0f612c679b6bdb16cf202b82bb43280c
- SHA1 6ebf6baeba81b4c33b93eb1b4c018e269cb24979
- SHA512 fe4603e2a0a1649822794d726ef5f7b216cca8dfc36b8d50d074f60835a99a9e3ccdca16964c1c0c4a4f5bfb980a480d7e0f794fdd2262af7514f39db93cc871
- SSDEEP 6144:8EK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdF7:8MpASIcWYx2U6hAJQnG
- TLSH T1A8D494685828C8D6E795D534E82CEB1596F48CF17B8300ABB076F9FCD4B22D161AF50E
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-04-23_0f612c679b6bdb16cf202b82bb43280c_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260130-en
7 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-04-23_0f612c679b6bdb16cf202b82bb43280c_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 594KB
- SHA256 0ce9a1a21b9b69fb0baf778b7f199ee0c769e07ce5d0a8a3b1eaf3120f816afc
- MD5 0f612c679b6bdb16cf202b82bb43280c
- SHA1 6ebf6baeba81b4c33b93eb1b4c018e269cb24979
- SHA512 fe4603e2a0a1649822794d726ef5f7b216cca8dfc36b8d50d074f60835a99a9e3ccdca16964c1c0c4a4f5bfb980a480d7e0f794fdd2262af7514f39db93cc871
- SSDEEP 6144:8EK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdF7:8MpASIcWYx2U6hAJQnG
- TLSH T1A8D494685828C8D6E795D534E82CEB1596F48CF17B8300ABB076F9FCD4B22D161AF50E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE