General
- Target 2026-07-29_9d05306fe24b012ab84e4d553341e83e_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
- Size 2.3MB
- Sample260729-vwglps1tez
- SHA256 a872f3ac1099895d935f10302911c634fab7588cdb893c83db4a2c714360509e
- MD5 9d05306fe24b012ab84e4d553341e83e
- SHA1 929114df2a318b170aae2354f45b844157966d60
- SHA512 d4694451d67240890a3e4f694fd750c7ee789fd840ff39248983c5c0ab188233ba8494af8d520646aab404d32b6667d9ac0c9ec20c6ee04bedb7b8b81a654363
- SSDEEP 49152:btzaEIG0aS4e6ZWt06MQ8E0jibIIS6SLMI:bNaEhW+Q8EC2RSQI
- TLSH T172B52302F2D2C071D86A00B505669BB64F36BD729BB5C5E39FD47D5E4E303E0AA3264E
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-29_9d05306fe24b012ab84e4d553341e83e_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-29_9d05306fe24b012ab84e4d553341e83e_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
- Size 2.3MB
- SHA256 a872f3ac1099895d935f10302911c634fab7588cdb893c83db4a2c714360509e
- MD5 9d05306fe24b012ab84e4d553341e83e
- SHA1 929114df2a318b170aae2354f45b844157966d60
- SHA512 d4694451d67240890a3e4f694fd750c7ee789fd840ff39248983c5c0ab188233ba8494af8d520646aab404d32b6667d9ac0c9ec20c6ee04bedb7b8b81a654363
- SSDEEP 49152:btzaEIG0aS4e6ZWt06MQ8E0jibIIS6SLMI:bNaEhW+Q8EC2RSQI
- TLSH T172B52302F2D2C071D86A00B505669BB64F36BD729BB5C5E39FD47D5E4E303E0AA3264E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
UPX dump on OEP (original entry point)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL