General
- Target 2026-04-23_4907ac6de1b4c2c9dd64415ca7bcfdd7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 409KB
- Sample260423-gfaasscs3y
- SHA256 eb5c77a135058a2e4bd8b130090c4eb610b7449b693bc00f5671263bef2f596a
- MD5 4907ac6de1b4c2c9dd64415ca7bcfdd7
- SHA1 c6fe2d9b6224fffc946a9ac12530ae2c0b67c299
- SHA512 cb5ab595e87792ded82810b5900dc1405ad4e0891ff5bf4a684b7d6f4c9c2bf2ec8ca1604711c2714bc430472d74b4ab351f44a209d6f5ddabba9814a04e73d0
- SSDEEP 6144:Y5SXvBoDWoyLYyzbwOC4DYM6SB6v+qLnAzYmhwrxcvkzmSB7ohVc:YIfBoDWoyFbkU6hAJQnag
- TLSH T1D094BD253540C436F3290B354855EAB10AA9BC3A14D9E48FF7787E7A6D321938B3B24F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-04-23_4907ac6de1b4c2c9dd64415ca7bcfdd7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260130-en
7 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-04-23_4907ac6de1b4c2c9dd64415ca7bcfdd7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 409KB
- SHA256 eb5c77a135058a2e4bd8b130090c4eb610b7449b693bc00f5671263bef2f596a
- MD5 4907ac6de1b4c2c9dd64415ca7bcfdd7
- SHA1 c6fe2d9b6224fffc946a9ac12530ae2c0b67c299
- SHA512 cb5ab595e87792ded82810b5900dc1405ad4e0891ff5bf4a684b7d6f4c9c2bf2ec8ca1604711c2714bc430472d74b4ab351f44a209d6f5ddabba9814a04e73d0
- SSDEEP 6144:Y5SXvBoDWoyLYyzbwOC4DYM6SB6v+qLnAzYmhwrxcvkzmSB7ohVc:YIfBoDWoyFbkU6hAJQnag
- TLSH T1D094BD253540C436F3290B354855EAB10AA9BC3A14D9E48FF7787E7A6D321938B3B24F
- MD5 SHA1 SHA512 SSDEEP TLSH
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE