General
- Target 2026-07-30_c7526ef5a512ef0063b60df0ee3bdb99_elex_karagany_redline-stealer_rhadamanthys_rifdoor_smoke-loader_stealc
- Size 80KB
- Sample260730-knt7qaee83
- SHA256 b2b3c30b7a3d6bfcde75dbef3f677ed9115ec1f38d33666eae94e6464d42efb2
- MD5 c7526ef5a512ef0063b60df0ee3bdb99
- SHA1 7f52dbe5bba110bd9d4befda8a82a5ae76225072
- SHA512 7a053d9c77f40294cc2dc17f5467143050ce100bf121da95125852c5ba9d62e82882c2e17a78733e6fb385be5b67d87d7bc585a5508c8378cd3c817f1359ac7d
- SSDEEP 1536:RLNIP9SaZTbFARlq7jC1OZstZu0TS3lEdUJrkb00wJjZd:RL+ZTZX3BAtTS3lEdUJrkb0nld
- TLSH T1F9838D117280C473E0A1143144BAD7B25ABEBC3366F999877B9417FE5E703D1AA39327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-30_c7526ef5a512ef0063b60df0ee3bdb99_elex_karagany_redline-stealer_rhadamanthys_rifdoor_smoke-loader_stealc.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_c7526ef5a512ef0063b60df0ee3bdb99_elex_karagany_redline-stealer_rhadamanthys_rifdoor_smoke-loader_stealc.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-30_c7526ef5a512ef0063b60df0ee3bdb99_elex_karagany_redline-stealer_rhadamanthys_rifdoor_smoke-loader_stealc
- Size 80KB
- SHA256 b2b3c30b7a3d6bfcde75dbef3f677ed9115ec1f38d33666eae94e6464d42efb2
- MD5 c7526ef5a512ef0063b60df0ee3bdb99
- SHA1 7f52dbe5bba110bd9d4befda8a82a5ae76225072
- SHA512 7a053d9c77f40294cc2dc17f5467143050ce100bf121da95125852c5ba9d62e82882c2e17a78733e6fb385be5b67d87d7bc585a5508c8378cd3c817f1359ac7d
- SSDEEP 1536:RLNIP9SaZTbFARlq7jC1OZstZu0TS3lEdUJrkb00wJjZd:RL+ZTZX3BAtTS3lEdUJrkb0nld
- TLSH T1F9838D117280C473E0A1143144BAD7B25ABEBC3366F999877B9417FE5E703D1AA39327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.