General
- Target 2026-07-09_3487a073129b21aad688b48f4d76974c_amadey_elex_rhadamanthys_smoke-loader_stop_urelas
- Size 647KB
- Sample260709-1dfvcahz6p
- SHA256 c552c2a5ece8e00088bd5a781fde4314889a04639fef1c0c41208e11b6ce3d09
- MD5 3487a073129b21aad688b48f4d76974c
- SHA1 4e6df13809cb635d535e5a17b7a08d31d16764ba
- SHA512 132d90fbcdc0140b8d976860782e6fda3b1215875f1e3b744eab3634b557a7fe9e7ffb2a9bce038956861a08f1a61c7386871525939b945718b8b80a54767cd1
- SSDEEP 12288:VU7M5ijWh0XOW4sEf9OTijWh0XOW4sEfwA:VUowYcOW4a2YcOW4N
- TLSH T125E4E01675408875F7290B310806FAE40AA9AD3E1AD4F54FF67CBE7968320979B3724F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-09_3487a073129b21aad688b48f4d76974c_amadey_elex_rhadamanthys_smoke-loader_stop_urelas.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.226
-
218.54.31.165
Targets
-
- Target 2026-07-09_3487a073129b21aad688b48f4d76974c_amadey_elex_rhadamanthys_smoke-loader_stop_urelas
- Size 647KB
- SHA256 c552c2a5ece8e00088bd5a781fde4314889a04639fef1c0c41208e11b6ce3d09
- MD5 3487a073129b21aad688b48f4d76974c
- SHA1 4e6df13809cb635d535e5a17b7a08d31d16764ba
- SHA512 132d90fbcdc0140b8d976860782e6fda3b1215875f1e3b744eab3634b557a7fe9e7ffb2a9bce038956861a08f1a61c7386871525939b945718b8b80a54767cd1
- SSDEEP 12288:VU7M5ijWh0XOW4sEf9OTijWh0XOW4sEfwA:VUowYcOW4a2YcOW4N
- TLSH T125E4E01675408875F7290B310806FAE40AA9AD3E1AD4F54FF67CBE7968320979B3724F
- MD5 SHA1 SHA512 SSDEEP TLSH
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE