General
- Target 2026-08-09_aa2bea2a4b3353e3dcaed3ea6a344b0b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 402KB
- Sample260809-frkp8s1cjb
- SHA256 3b18c33980fea1fdfa3b857259c929bd9e7ca7cfa4a3b08d7c6b5532c36028f5
- MD5 aa2bea2a4b3353e3dcaed3ea6a344b0b
- SHA1 86d47db67cf7fe2c1b5f7402851bbb5ca69ae2cb
- SHA512 8852566bd0c07f31fb2761fe68727a5d55b9c0dac3e06f72d364c5f5c2872c91c4af0b1aee41bcd763f8e527eed4e788542acc9c089c7aa5c258ce6918c26755
- SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBwLTvEs:yIfBoDWoyFboU6hAJQnrU
- TLSH T10194BD253140C436F32A0B354456EAB109A9BC3915D9E48FF778BE7A5E311939B3B28F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-09_aa2bea2a4b3353e3dcaed3ea6a344b0b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-08-09_aa2bea2a4b3353e3dcaed3ea6a344b0b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 402KB
- SHA256 3b18c33980fea1fdfa3b857259c929bd9e7ca7cfa4a3b08d7c6b5532c36028f5
- MD5 aa2bea2a4b3353e3dcaed3ea6a344b0b
- SHA1 86d47db67cf7fe2c1b5f7402851bbb5ca69ae2cb
- SHA512 8852566bd0c07f31fb2761fe68727a5d55b9c0dac3e06f72d364c5f5c2872c91c4af0b1aee41bcd763f8e527eed4e788542acc9c089c7aa5c258ce6918c26755
- SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBwLTvEs:yIfBoDWoyFboU6hAJQnrU
- TLSH T10194BD253140C436F32A0B354456EAB109A9BC3915D9E48FF778BE7A5E311939B3B28F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE