General
- Target 2026-07-31_45b7101a4d279fade3c071776b309819_amadey_elex_konni_smoke-loader_stealc_stop_tofsee
- Size 2.9MB
- Sample260731-31ab7aaf76
- SHA256 0417ed3af3b2d6f3579d6e0a129696ab7c127311b48b8e2582a8c953d78fc999
- MD5 45b7101a4d279fade3c071776b309819
- SHA1 84c0ed70a9f1e8dd3c73b0fc12a2a3eb3052d6b1
- SHA512 f74c1131b91e30d4006b558cac31a9bfaf694ffb8f62f06a1355828eaf6a72c8fb2f0be9af0989e25279a3a81ab16e3865c8048abe77c8f948559923a233399c
- SSDEEP 49152:wNZK5T3E0ydrPOHtTUzXiadDKTcyOP5q/AsRWnJ1v0AG+3vhWtQu0HHN+q2Q0j:wK60CrPGtTsZiYsonP4+3vot30HHN+qc
- TLSH T1E7E5232325D5D033D51B5C319AEA9322EC7AF42E5B2618CAAB410F1E7B255F1C72B783
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-31_45b7101a4d279fade3c071776b309819_amadey_elex_konni_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_45b7101a4d279fade3c071776b309819_amadey_elex_konni_smoke-loader_stealc_stop_tofsee.exe
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-31_45b7101a4d279fade3c071776b309819_amadey_elex_konni_smoke-loader_stealc_stop_tofsee
- Size 2.9MB
- SHA256 0417ed3af3b2d6f3579d6e0a129696ab7c127311b48b8e2582a8c953d78fc999
- MD5 45b7101a4d279fade3c071776b309819
- SHA1 84c0ed70a9f1e8dd3c73b0fc12a2a3eb3052d6b1
- SHA512 f74c1131b91e30d4006b558cac31a9bfaf694ffb8f62f06a1355828eaf6a72c8fb2f0be9af0989e25279a3a81ab16e3865c8048abe77c8f948559923a233399c
- SSDEEP 49152:wNZK5T3E0ydrPOHtTUzXiadDKTcyOP5q/AsRWnJ1v0AG+3vhWtQu0HHN+q2Q0j:wK60CrPGtTsZiYsonP4+3vot30HHN+qc
- TLSH T1E7E5232325D5D033D51B5C319AEA9322EC7AF42E5B2618CAAB410F1E7B255F1C72B783
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables calling ClearMyTracksByProcess
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application