General
- Target 2026-07-19_b78a0b1afa1dc4b92871a0eda8106bf4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 409KB
- Sample260720-a25khacz31
- SHA256 2bb1c124c5d504a1ae51b01f432998638fa60574ac94357ab323ff0d31595979
- MD5 b78a0b1afa1dc4b92871a0eda8106bf4
- SHA1 0f93c03cd69a9b48ee2c34eb3e7412e37f530540
- SHA512 91d094bb645703b33dccfa8333f73d21bc886c2d4b9d9ea3153d99bf3b341a0ca8b77c2a9171c8ddbcdce94cba4712c5a54341e4f6f2d2d060c773a1f2dda58e
- SSDEEP 6144:Y5SXvBoDWoyLYyzbwOC4DYM6SB6v+qLnAzYmhwrxcvkzmSB7ohVa:YIfBoDWoyFbkU6hAJQna+
- TLSH T10894BE253540C436F3290B354855EAB10AA9BC3A14D9E48FF7787E7A6D321938B7B24F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-19_b78a0b1afa1dc4b92871a0eda8106bf4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-07-19_b78a0b1afa1dc4b92871a0eda8106bf4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 409KB
- SHA256 2bb1c124c5d504a1ae51b01f432998638fa60574ac94357ab323ff0d31595979
- MD5 b78a0b1afa1dc4b92871a0eda8106bf4
- SHA1 0f93c03cd69a9b48ee2c34eb3e7412e37f530540
- SHA512 91d094bb645703b33dccfa8333f73d21bc886c2d4b9d9ea3153d99bf3b341a0ca8b77c2a9171c8ddbcdce94cba4712c5a54341e4f6f2d2d060c773a1f2dda58e
- SSDEEP 6144:Y5SXvBoDWoyLYyzbwOC4DYM6SB6v+qLnAzYmhwrxcvkzmSB7ohVa:YIfBoDWoyFbkU6hAJQna+
- TLSH T10894BE253540C436F3290B354855EAB10AA9BC3A14D9E48FF7787E7A6D321938B7B24F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE