General
- Target 2026-07-01_dc2c8d70fd03e5cde25533277be6d5a3_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
- Size 72KB
- Sample260701-b479vab15q
- SHA256 06af393b842f3f78bf6cd3bd871318c7f01a514d7a6baed857fcedc28a2ea49d
- MD5 dc2c8d70fd03e5cde25533277be6d5a3
- SHA1 bac63cc0cb52c34b879b6c204c2e433d82a2eb3f
- SHA512 5d2fae7809213c187c1ece36419d34e956777291e17c99d4e34dcbf241d15f2e93ecc7c2394b7532076e68bb7c108234a466a524b34256b067891c9d429d060e
- SSDEEP 768:+00UHf57LnWykdBdusOAL/2DH9owR97k9/l4ElXYWFoHiPI6zDwhT6cBJhFd/B5Y:+00URPnKfZrT2DawRR8JfP30ZB355B/
- TLSH T1FC738E467881C4B2D80054B41826C6929FBFAD1257A5D0CBFB993E7E9F313DB893938D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-01_dc2c8d70fd03e5cde25533277be6d5a3_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-01_dc2c8d70fd03e5cde25533277be6d5a3_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Resource
win11ltsc2024-20260630-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-01_dc2c8d70fd03e5cde25533277be6d5a3_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
- Size 72KB
- SHA256 06af393b842f3f78bf6cd3bd871318c7f01a514d7a6baed857fcedc28a2ea49d
- MD5 dc2c8d70fd03e5cde25533277be6d5a3
- SHA1 bac63cc0cb52c34b879b6c204c2e433d82a2eb3f
- SHA512 5d2fae7809213c187c1ece36419d34e956777291e17c99d4e34dcbf241d15f2e93ecc7c2394b7532076e68bb7c108234a466a524b34256b067891c9d429d060e
- SSDEEP 768:+00UHf57LnWykdBdusOAL/2DH9owR97k9/l4ElXYWFoHiPI6zDwhT6cBJhFd/B5Y:+00URPnKfZrT2DawRR8JfP30ZB355B/
- TLSH T1FC738E467881C4B2D80054B41826C6929FBFAD1257A5D0CBFB993E7E9F313DB893938D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory