General
- Target 2026-08-02_2dc818a12aff6dae6a5a5723f56f5871_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee
- Size 441KB
- Sample260802-n4c5xssdka
- SHA256 df19e596b06ca1ffe1898a071596547c87f65f340a19d951d7ba4bbaef146025
- MD5 2dc818a12aff6dae6a5a5723f56f5871
- SHA1 81eefe2c59afb27d8aa6baaec5752974557e797a
- SHA512 8d19a3f36269f5b02a3e81d4e475d511e7950e66d89d6ca83f4b5f4ec2a92c6635666b53f81d2060fc6d7f1ca6deec006793d687b9faede9a207c051189e574a
- SSDEEP 6144:oo3wBi+1Py3V0a2WkRNgi3caOHO5NjEwwiYWB5mV4Pzw9ygibGG/X:rKf1PyKa2H3hOHOHz9JQ6zB9
- TLSH T1F6A4AE2572808435F76A0B3049A5E6F50868BC392BA9E58FF368BD392D701D35A7335F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-02_2dc818a12aff6dae6a5a5723f56f5871_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
1.234.83.146
-
133.242.129.155
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-08-02_2dc818a12aff6dae6a5a5723f56f5871_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee
- Size 441KB
- SHA256 df19e596b06ca1ffe1898a071596547c87f65f340a19d951d7ba4bbaef146025
- MD5 2dc818a12aff6dae6a5a5723f56f5871
- SHA1 81eefe2c59afb27d8aa6baaec5752974557e797a
- SHA512 8d19a3f36269f5b02a3e81d4e475d511e7950e66d89d6ca83f4b5f4ec2a92c6635666b53f81d2060fc6d7f1ca6deec006793d687b9faede9a207c051189e574a
- SSDEEP 6144:oo3wBi+1Py3V0a2WkRNgi3caOHO5NjEwwiYWB5mV4Pzw9ygibGG/X:rKf1PyKa2H3hOHOHz9JQ6zB9
- TLSH T1F6A4AE2572808435F76A0B3049A5E6F50868BC392BA9E58FF368BD392D701D35A7335F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE