General
- Target 2026-05-04_36b1b65212114e825f3c676a44dbfa47_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 455KB
- Sample260504-wpb83sdx7l
- SHA256 a9f62631b634a7683051273335496a1153c55d7189b24552f45c6c9babe0aba1
- MD5 36b1b65212114e825f3c676a44dbfa47
- SHA1 1dc35b0e8e4eb597241a7d4ff09b23497be0a16e
- SHA512 59e7b2d55c191089a9d009b552fda0634db7552f0221db8636fcf4673376842df4f088def86701cec0bb08cf3fd0bd2b4b59937bef5e4cabf3310e8eaacf36e4
- SSDEEP 6144:PEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpopB9k:PMpASIcWYx2U6hAJQnO
- TLSH T1D1A4BD147640D472E32A0B310456EAB449A9AC3A17D9E48FF3387E766D312D3977B28F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-05-04_36b1b65212114e825f3c676a44dbfa47_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260130-en
7 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-05-04_36b1b65212114e825f3c676a44dbfa47_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 455KB
- SHA256 a9f62631b634a7683051273335496a1153c55d7189b24552f45c6c9babe0aba1
- MD5 36b1b65212114e825f3c676a44dbfa47
- SHA1 1dc35b0e8e4eb597241a7d4ff09b23497be0a16e
- SHA512 59e7b2d55c191089a9d009b552fda0634db7552f0221db8636fcf4673376842df4f088def86701cec0bb08cf3fd0bd2b4b59937bef5e4cabf3310e8eaacf36e4
- SSDEEP 6144:PEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpopB9k:PMpASIcWYx2U6hAJQnO
- TLSH T1D1A4BD147640D472E32A0B310456EAB449A9AC3A17D9E48FF3387E766D312D3977B28F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE