General
- Target 2026-08-03_f1f18ddd37b8bb78ff687b7af76792a9_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee
- Size 439KB
- Sample260804-kyq8tabn8z
- SHA256 2ea7fe45532c05cbd47996e4d593e3861b340e7fec51f4386ac28e8860c32411
- MD5 f1f18ddd37b8bb78ff687b7af76792a9
- SHA1 6b67f1cefd626506e1c80185c09bb79f17c2c947
- SHA512 3b60a7e751f4a6c3948007a03aa6410d046d9759292cb5ce73652e28557a247beba9cdf4f416d926d080eb758d4dc6a511c8f600e8a9fb0b7985d1d40bcae4ac
- SSDEEP 6144:oo3wBi+1Py3V0a2WkRNgi3caOHO5NjEwwiYWB5mV4Pzw9ygibGGs:rKf1PyKa2H3hOHOHz9JQ6zBW
- TLSH T174A4BE2572808435F76A0B3049A5E6E50868BC3927A9E58FF378BD3A2D701D35A7335F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-03_f1f18ddd37b8bb78ff687b7af76792a9_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
1.234.83.146
-
133.242.129.155
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-08-03_f1f18ddd37b8bb78ff687b7af76792a9_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee
- Size 439KB
- SHA256 2ea7fe45532c05cbd47996e4d593e3861b340e7fec51f4386ac28e8860c32411
- MD5 f1f18ddd37b8bb78ff687b7af76792a9
- SHA1 6b67f1cefd626506e1c80185c09bb79f17c2c947
- SHA512 3b60a7e751f4a6c3948007a03aa6410d046d9759292cb5ce73652e28557a247beba9cdf4f416d926d080eb758d4dc6a511c8f600e8a9fb0b7985d1d40bcae4ac
- SSDEEP 6144:oo3wBi+1Py3V0a2WkRNgi3caOHO5NjEwwiYWB5mV4Pzw9ygibGGs:rKf1PyKa2H3hOHOHz9JQ6zBW
- TLSH T174A4BE2572808435F76A0B3049A5E6E50868BC3927A9E58FF378BD3A2D701D35A7335F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE