General
- Target 2026-06-01_25447a4420f2dcfe19c9be5328f648a9_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
- Size 29.9MB
- Sample260601-prfkyscs3v
- SHA256 225ec9ca6517c528985a8c2f18382c8f407be70df3e4928be8ec46d1a12549aa
- MD5 25447a4420f2dcfe19c9be5328f648a9
- SHA1 a82a310e7e4c5dee10833dccf8a5dd1357fcdc09
- SHA512 d50ee1aa247bb01882c9ba839fe52fdee07f0efef1b39c6167ea5ca8ffae226dffbf86e5f65e7fea84d3424421ce1ad3912ec44ea48ed71f10b451e7c73470c6
- SSDEEP 786432:KFRdL3yFbqxz4ejIu5JW9YSrDDA0Dkrhm81B5MlxGZo:A9xz4NAJWy+DxkrXPo
- TLSH T16A673387B3D384B3D5698134196246B12A326C329BB7D0E3B7DCBE664E343C0967639D
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-06-01_25447a4420f2dcfe19c9be5328f648a9_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-01_25447a4420f2dcfe19c9be5328f648a9_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
- Size 29.9MB
- SHA256 225ec9ca6517c528985a8c2f18382c8f407be70df3e4928be8ec46d1a12549aa
- MD5 25447a4420f2dcfe19c9be5328f648a9
- SHA1 a82a310e7e4c5dee10833dccf8a5dd1357fcdc09
- SHA512 d50ee1aa247bb01882c9ba839fe52fdee07f0efef1b39c6167ea5ca8ffae226dffbf86e5f65e7fea84d3424421ce1ad3912ec44ea48ed71f10b451e7c73470c6
- SSDEEP 786432:KFRdL3yFbqxz4ejIu5JW9YSrDDA0Dkrhm81B5MlxGZo:A9xz4NAJWy+DxkrXPo
- TLSH T16A673387B3D384B3D5698134196246B12A326C329BB7D0E3B7DCBE664E343C0967639D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
UPX dump on OEP (original entry point)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL