General
- Target 2026-08-08_279999cb82ba5ccff9511da5d85b61eb_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
- Size 2.9MB
- Sample260808-r37vpasyex
- SHA256 d3170c1c124b1553b021db1a68d300d9e145f6f09313dc0f78f3bad76a9fd773
- MD5 279999cb82ba5ccff9511da5d85b61eb
- SHA1 35bd089f124cfdc28fe09de4fd8b91080ce2ae45
- SHA512 5a989a2fa56ec3c903642a8653ac0d9850c3f4b8b67b717d87685c3fddf57422baf510e9e02ff7142f602f5af943c0d4d957bf963ad79567a06a60c1223a2644
- SSDEEP 49152:ON26FOnzGn6LJvqkwnpC+mWd6uIccD3XJmYtUtXg8Aizf3cJ7Wx:O06FOznLo0+Dd6uxcD3dutXJGc
- TLSH T1C7E52202F6D2C0B1E4B906B4057187B64F757E724BB5C6E7ABC0796E4D713E0AA3231A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-08_279999cb82ba5ccff9511da5d85b61eb_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-08_279999cb82ba5ccff9511da5d85b61eb_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
- Size 2.9MB
- SHA256 d3170c1c124b1553b021db1a68d300d9e145f6f09313dc0f78f3bad76a9fd773
- MD5 279999cb82ba5ccff9511da5d85b61eb
- SHA1 35bd089f124cfdc28fe09de4fd8b91080ce2ae45
- SHA512 5a989a2fa56ec3c903642a8653ac0d9850c3f4b8b67b717d87685c3fddf57422baf510e9e02ff7142f602f5af943c0d4d957bf963ad79567a06a60c1223a2644
- SSDEEP 49152:ON26FOnzGn6LJvqkwnpC+mWd6uIccD3XJmYtUtXg8Aizf3cJ7Wx:O06FOznLo0+Dd6uxcD3dutXJGc
- TLSH T1C7E52202F6D2C0B1E4B906B4057187B64F757E724BB5C6E7ABC0796E4D713E0AA3231A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
UPX dump on OEP (original entry point)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL