General
- Target 2026-08-01_2cc084b7cd71afa485947a9489fa4cea_amadey_elex_redline-stealer_smoke-loader_stealc_stop
- Size 123KB
- Sample260801-d5qsasdp3v
- SHA256 861e8da544da73e711146d67228006f1f78da25ab446490a9a69a4b7bc15685a
- MD5 2cc084b7cd71afa485947a9489fa4cea
- SHA1 6e3203079a6e1546861a84ac4330ee6a9d639331
- SHA512 0c3f180bee2f52437a8d00269b8bb60574ecbb89ddf10d8d49d03cbe414fe8a97b616a13d1075775dda8050bcfe273f8c92378918428d0279aa85c9140b9daa0
- SSDEEP 1536:yVYYRiu+5Acd1DlWlhJ3a9MqjBturIk31lFNdrioIlk5adwtsy:CMuDlhURurt/NdrN4k5aFy
- TLSH T173C37B217941C033C48AA5701719E372EA3D693166B99587F38D0FFA6EB03D0AA3D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_2cc084b7cd71afa485947a9489fa4cea_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_2cc084b7cd71afa485947a9489fa4cea_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe
Resource
win11ltsc2024-20260710-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-01_2cc084b7cd71afa485947a9489fa4cea_amadey_elex_redline-stealer_smoke-loader_stealc_stop
- Size 123KB
- SHA256 861e8da544da73e711146d67228006f1f78da25ab446490a9a69a4b7bc15685a
- MD5 2cc084b7cd71afa485947a9489fa4cea
- SHA1 6e3203079a6e1546861a84ac4330ee6a9d639331
- SHA512 0c3f180bee2f52437a8d00269b8bb60574ecbb89ddf10d8d49d03cbe414fe8a97b616a13d1075775dda8050bcfe273f8c92378918428d0279aa85c9140b9daa0
- SSDEEP 1536:yVYYRiu+5Acd1DlWlhJ3a9MqjBturIk31lFNdrioIlk5adwtsy:CMuDlhURurt/NdrN4k5aFy
- TLSH T173C37B217941C033C48AA5701719E372EA3D693166B99587F38D0FFA6EB03D0AA3D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.