General
- Target 2026-07-21_baf7f615d0a5e3b45187fa2a5cb65eb7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 402KB
- Sample260721-efse9sfw2v
- SHA256 daad91716f3d595814293fb351562db45aa421d3b25365bea6be3061cf228f40
- MD5 baf7f615d0a5e3b45187fa2a5cb65eb7
- SHA1 d677f1002e5e33da12f6cbe88b70887fd9f794de
- SHA512 a86678200a81f8e243cfb5ae59d565ba27e2d1ec40e0aae6903e5d720a7356b8bc27df6f7f90479422db79bd4d830a88216aa062c1d41bcc8453a85a7fa21511
- SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBwLTvEh:yIfBoDWoyFboU6hAJQnrJ
- TLSH T1F094BD253140C436F32A0B354456EAB109A9BC3915D9E48FF778BE7A5E311939B3B28F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-21_baf7f615d0a5e3b45187fa2a5cb65eb7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-07-21_baf7f615d0a5e3b45187fa2a5cb65eb7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 402KB
- SHA256 daad91716f3d595814293fb351562db45aa421d3b25365bea6be3061cf228f40
- MD5 baf7f615d0a5e3b45187fa2a5cb65eb7
- SHA1 d677f1002e5e33da12f6cbe88b70887fd9f794de
- SHA512 a86678200a81f8e243cfb5ae59d565ba27e2d1ec40e0aae6903e5d720a7356b8bc27df6f7f90479422db79bd4d830a88216aa062c1d41bcc8453a85a7fa21511
- SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBwLTvEh:yIfBoDWoyFboU6hAJQnrJ
- TLSH T1F094BD253140C436F32A0B354456EAB109A9BC3915D9E48FF778BE7A5E311939B3B28F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE