General
- Target 2026-08-06_4d985596577360dfe926fd17ef1851ff_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 402KB
- Sample260806-nsymgst1ex
- SHA256 2e2244e38cf2ac90b744c34ebb0b2eff5e3aa836459b879e4c3762bf13e3eee1
- MD5 4d985596577360dfe926fd17ef1851ff
- SHA1 643c65062c522cf865c334fee3cac5e4a86c4c77
- SHA512 248c92d7e2ae0e0bbab05d7b30c7d1ca12ff887b4d318cbff5591fcec0521915666b222b9be926f9027287bcbb9c2696b5d09c49b8ef3d040ca7e7e0477f0131
- SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBwLTv1a:yIfBoDWoyFboU6hAJQnrP
- TLSH T12794BE253140C436F32A0B354456EAB049A9BC3915D9E48FF778BE7A5E311938B3B28F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-06_4d985596577360dfe926fd17ef1851ff_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-08-06_4d985596577360dfe926fd17ef1851ff_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 402KB
- SHA256 2e2244e38cf2ac90b744c34ebb0b2eff5e3aa836459b879e4c3762bf13e3eee1
- MD5 4d985596577360dfe926fd17ef1851ff
- SHA1 643c65062c522cf865c334fee3cac5e4a86c4c77
- SHA512 248c92d7e2ae0e0bbab05d7b30c7d1ca12ff887b4d318cbff5591fcec0521915666b222b9be926f9027287bcbb9c2696b5d09c49b8ef3d040ca7e7e0477f0131
- SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBwLTv1a:yIfBoDWoyFboU6hAJQnrP
- TLSH T12794BE253140C436F32A0B354456EAB049A9BC3915D9E48FF778BE7A5E311938B3B28F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE