General
- Target 2026-08-03_b02f9555aee6e095f33a2e9e74e209e2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
- Size 72KB
- Sample260803-kw8ebafa79
- SHA256 f660b98b92c6b75b37dceecddab8f8fa13fc72699c55ff82c262100afd0395ec
- MD5 b02f9555aee6e095f33a2e9e74e209e2
- SHA1 c6556d1971d9a934f854f7f0245d7ba97a106095
- SHA512 491e564474c2950d6ef1c091bd5d98b8f4a6e787ce8d3dcf568ac049c865bc68da4a2c5d22e1d30a699f625731ab87c9ceb81ad193b6fb6fb1b98c9cfd73257a
- SSDEEP 768:+00UHf57LnWykdBdusOAL/2DH9owR97k9/l4ElXYWFoHiPI6zDwxT6cBJhFd/B5Y:+00URPnKfZrT2DawRR8JfP3AZB355B/
- TLSH T174738E467881C4B2D80054B41826C6929FBFAD1257A5D0CBFB993E7E9F313DB893938D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_b02f9555aee6e095f33a2e9e74e209e2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_b02f9555aee6e095f33a2e9e74e209e2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-03_b02f9555aee6e095f33a2e9e74e209e2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
- Size 72KB
- SHA256 f660b98b92c6b75b37dceecddab8f8fa13fc72699c55ff82c262100afd0395ec
- MD5 b02f9555aee6e095f33a2e9e74e209e2
- SHA1 c6556d1971d9a934f854f7f0245d7ba97a106095
- SHA512 491e564474c2950d6ef1c091bd5d98b8f4a6e787ce8d3dcf568ac049c865bc68da4a2c5d22e1d30a699f625731ab87c9ceb81ad193b6fb6fb1b98c9cfd73257a
- SSDEEP 768:+00UHf57LnWykdBdusOAL/2DH9owR97k9/l4ElXYWFoHiPI6zDwxT6cBJhFd/B5Y:+00URPnKfZrT2DawRR8JfP3AZB355B/
- TLSH T174738E467881C4B2D80054B41826C6929FBFAD1257A5D0CBFB993E7E9F313DB893938D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory