General
- Target 2026-07-12_4d4889284d5a8212d09904146ffc1252_amadey_elex_redline-stealer_remcos_rhadamanthys_smoke-loader_stop
- Size 538KB
- Sample260712-vrrwwaf14w
- SHA256 9bfb4547ce03f965fd59a6373bc0111e2c434a999de058e15e2e8f40e2c0fffd
- MD5 4d4889284d5a8212d09904146ffc1252
- SHA1 85c25fed3b1f047f00cc5e48c8a6ba114730e2ea
- SHA512 6b723d54b1ae1911cec33c971a16db309172175bc9333dd1ec464e1e1ad7b610f746947ddceed412fe9fc17587b0edff462f1bba3b7405e2b1c0c1fd5b5023ad
- SSDEEP 6144:KAI8Q42CfyrBcSdtUgfIk6GCBes2xMdLRmkw5HJZ5EAhsqFbnojDuUl04iJ6qV:KBwfADGgfIkXCBepCdLsZ5EEeDuUl0m2
- TLSH T165C48D1377E0C032E5B306714D768725AB7ABC612F34C99B27C42A4E5EB26D2AE31717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-12_4d4889284d5a8212d09904146ffc1252_amadey_elex_redline-stealer_remcos_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-12_4d4889284d5a8212d09904146ffc1252_amadey_elex_redline-stealer_remcos_rhadamanthys_smoke-loader_stop.exe
Resource
win11ltsc2024-20260710-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-12_4d4889284d5a8212d09904146ffc1252_amadey_elex_redline-stealer_remcos_rhadamanthys_smoke-loader_stop
- Size 538KB
- SHA256 9bfb4547ce03f965fd59a6373bc0111e2c434a999de058e15e2e8f40e2c0fffd
- MD5 4d4889284d5a8212d09904146ffc1252
- SHA1 85c25fed3b1f047f00cc5e48c8a6ba114730e2ea
- SHA512 6b723d54b1ae1911cec33c971a16db309172175bc9333dd1ec464e1e1ad7b610f746947ddceed412fe9fc17587b0edff462f1bba3b7405e2b1c0c1fd5b5023ad
- SSDEEP 6144:KAI8Q42CfyrBcSdtUgfIk6GCBes2xMdLRmkw5HJZ5EAhsqFbnojDuUl04iJ6qV:KBwfADGgfIkXCBepCdLsZ5EEeDuUl0m2
- TLSH T165C48D1377E0C032E5B306714D768725AB7ABC612F34C99B27C42A4E5EB26D2AE31717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE