General

  • Target
    2026-07-02_a7a51041965c45957f563f6bfc35d26c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
  • Size 448KB
  • Sample260702-2jth3afy8w
  • SHA256 08631b11b698c00ea405f5e7ff5380db10a61596afe7aa7bd8720534d9c973ea
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • mylobot

C2
  • pqrqtaz.ru:9879

  • quwkbin.ru:3496

  • rkbupij.ru:6653

  • pcqmayq.ru:3629

  • mmuliwe.ru:3541

  • stoizji.ru:5189

  • sfdfrhh.ru:3511

  • ynciazz.ru:4127

  • mkglhnw.ru:1946

  • njeeili.ru:9987

  • dldzeoo.ru:7525

  • tkbiqjq.ru:5145

  • uenosbl.ru:2935

  • faayshc.ru:9865

  • nttfazc.ru:6761

  • nfwsyog.ru:7172

  • uyfusxm.ru:7372

  • hxkclwx.ru:1294

  • zgoysam.ru:2338

  • xtwbsox.ru:2279

Targets

    • Target
      2026-07-02_a7a51041965c45957f563f6bfc35d26c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
    • Size 448KB
    • SHA256 08631b11b698c00ea405f5e7ff5380db10a61596afe7aa7bd8720534d9c973ea
    • MD5 SHA1 SHA512 SSDEEP TLSH
    • Family: Mylobot

      Botnet which first appeared in 2017 written in C++.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks