General
- Target 2026-08-09_9c04f8b3bd03fb552dac0b5bbed79b24_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee
- Size 431KB
- Sample260809-hdbarasdqf
- SHA256 0da430cb7e82530572385664fdd4e1986c94bba0a71335efd3806106ad1a4a40
- MD5 9c04f8b3bd03fb552dac0b5bbed79b24
- SHA1 0e6fece27edbca9fe827004fe99bfe2fdcb3550a
- SHA512 c4417735aca8a8f61aa9fef63c048b7f32713cc79b95bc031d633b2364c92dacbe111a894826bca96b0ce6f52fa81c053620ea4d01f98679282dd8dd9caf0d7a
- SSDEEP 6144:to3wRi+1Py3V0a2WkQ6P9N2Y/Op9eXQ6fU//BFuHt07Vx9Ulh:w6f1PyKa2u6P9N2y3U/mHyUh
- TLSH T1AD94AE2072508075F3AA0B3059A5E6F548687D3917A4E48FF7787E3A29712D39A7338F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-09_9c04f8b3bd03fb552dac0b5bbed79b24_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
1.234.83.146
-
133.242.129.155
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-08-09_9c04f8b3bd03fb552dac0b5bbed79b24_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee
- Size 431KB
- SHA256 0da430cb7e82530572385664fdd4e1986c94bba0a71335efd3806106ad1a4a40
- MD5 9c04f8b3bd03fb552dac0b5bbed79b24
- SHA1 0e6fece27edbca9fe827004fe99bfe2fdcb3550a
- SHA512 c4417735aca8a8f61aa9fef63c048b7f32713cc79b95bc031d633b2364c92dacbe111a894826bca96b0ce6f52fa81c053620ea4d01f98679282dd8dd9caf0d7a
- SSDEEP 6144:to3wRi+1Py3V0a2WkQ6P9N2Y/Op9eXQ6fU//BFuHt07Vx9Ulh:w6f1PyKa2u6P9N2y3U/mHyUh
- TLSH T1AD94AE2072508075F3AA0B3059A5E6F548687D3917A4E48FF7787E3A29712D39A7338F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE