General
- Target 2026-08-01_0cf7efb48610a0ade0b6eab89ae7ac1b_elex_karagany_redline-stealer_rhadamanthys_rifdoor_smoke-loader_stealc
- Size 77KB
- Sample260802-ezzcxsda22
- SHA256 96c8e40f77dc565148ca069d9a3723305922dc50c3f6c732ae265aad22d4bd8c
- MD5 0cf7efb48610a0ade0b6eab89ae7ac1b
- SHA1 179e928df7bbb815e90e0ed60cf23ffcfc9bf500
- SHA512 d7e67c85db069582bfec8a7f37742e5fe7c63b8c545a98f4a84c73d8b99ec5f19bd2c4bc215441c8356af36ca8a1320c8e0409e314f94fa5fbd8dd1cbb4d9d5b
- SSDEEP 1536:nLNIW39SaZTbFARlq7jC1OZstZu0TS3gEdUJCkb0FGz:nLlbZTZX3BAtTS3gEdUJCkb0FGz
- TLSH T1E2737E127290C433E5A2193544B9D7B28A7EBD7376F8D887779807EA1E703D06A3931B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_0cf7efb48610a0ade0b6eab89ae7ac1b_elex_karagany_redline-stealer_rhadamanthys_rifdoor_smoke-loader_stealc.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_0cf7efb48610a0ade0b6eab89ae7ac1b_elex_karagany_redline-stealer_rhadamanthys_rifdoor_smoke-loader_stealc.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-01_0cf7efb48610a0ade0b6eab89ae7ac1b_elex_karagany_redline-stealer_rhadamanthys_rifdoor_smoke-loader_stealc
- Size 77KB
- SHA256 96c8e40f77dc565148ca069d9a3723305922dc50c3f6c732ae265aad22d4bd8c
- MD5 0cf7efb48610a0ade0b6eab89ae7ac1b
- SHA1 179e928df7bbb815e90e0ed60cf23ffcfc9bf500
- SHA512 d7e67c85db069582bfec8a7f37742e5fe7c63b8c545a98f4a84c73d8b99ec5f19bd2c4bc215441c8356af36ca8a1320c8e0409e314f94fa5fbd8dd1cbb4d9d5b
- SSDEEP 1536:nLNIW39SaZTbFARlq7jC1OZstZu0TS3gEdUJCkb0FGz:nLlbZTZX3BAtTS3gEdUJCkb0FGz
- TLSH T1E2737E127290C433E5A2193544B9D7B28A7EBD7376F8D887779807EA1E703D06A3931B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.