General
- Target 2026-04-19_34ac6427a512b0e942c1a132ca6e41a7_amadey_dma-locker_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc
- Size 95KB
- Sample260616-kpyarsav8r
- SHA256 7faa277fb71cd1b5760589a71461aaf7ec6829c4461bdd4ed2fef9a5b48e535e
- MD5 34ac6427a512b0e942c1a132ca6e41a7
- SHA1 72a46f5d2534638d9c232674d0f2863bec1b5ec6
- SHA512 9f7877a16cb965a3190b024799d0a16bfdd81142e40d00488ff41a31bcf816d48878d49d18f2577ff74481bdc0f0aba7b55e1e457de0a8c4dbfba0d1bded59de
- SSDEEP 1536:af8IJe85gIKtPYFYPx4oQCSUNRPXZEAokCt4ULG8hiR:afZLgZ0CVRfZEAqt4ULG8hi
- TLSH T1A5A38D1172D1C03AD062113148B5DBB28E7EB8320B7996C777980BBE9F607D2DA7935B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-19_34ac6427a512b0e942c1a132ca6e41a7_amadey_dma-locker_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc.exe
Resource
win10v2004-20260513-en
9 signatures
300 seconds
Behavioral task
behavioral2
Sample
2026-04-19_34ac6427a512b0e942c1a132ca6e41a7_amadey_dma-locker_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc.exe
Resource
win11-20260513-en
5 signatures
300 seconds
Malware Config
Targets
-
- Target 2026-04-19_34ac6427a512b0e942c1a132ca6e41a7_amadey_dma-locker_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc
- Size 95KB
- SHA256 7faa277fb71cd1b5760589a71461aaf7ec6829c4461bdd4ed2fef9a5b48e535e
- MD5 34ac6427a512b0e942c1a132ca6e41a7
- SHA1 72a46f5d2534638d9c232674d0f2863bec1b5ec6
- SHA512 9f7877a16cb965a3190b024799d0a16bfdd81142e40d00488ff41a31bcf816d48878d49d18f2577ff74481bdc0f0aba7b55e1e457de0a8c4dbfba0d1bded59de
- SSDEEP 1536:af8IJe85gIKtPYFYPx4oQCSUNRPXZEAokCt4ULG8hiR:afZLgZ0CVRfZEAqt4ULG8hi
- TLSH T1A5A38D1172D1C03AD062113148B5DBB28E7EB8320B7996C777980BBE9F607D2DA7935B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Family: DMA Locker
Ransomware family with some advanced features, like encryption of unmapped network shares.
-
Adds Run key to start application