General
- Target 2026-08-10_15958ed48e32e749a2fbf9055438d26b_amadey_elex_redline-stealer_smoke-loader_stealc_stop
- Size 136KB
- Sample260810-2wy93s1aph
- SHA256 d753c61cb7b81ece0106d483fda4c59e26649dfcb32a942f9e300a871b527215
- MD5 15958ed48e32e749a2fbf9055438d26b
- SHA1 8f9bdc8c20f06c5e76ba6064070e4aa6808010ba
- SHA512 f7e47a13850254c0473debe47d921504f87e3a063180342c2309df82a1a5031c24fcd96a54c312154463970295d79432e053d3ba070ab8b9de0be5030a47e335
- SSDEEP 1536:46BCqjmug1b465/qUlkF3rHlTa2BEQqFkxDipTn5SA4TrRqwtsUUxtf9rtX5:n6dlQ3fEoyTn5SZTrRYzX5
- TLSH T1E2D39D107881C533C44ACA341419DB669E3E7A3126B89583F3991FFA5FB13E96A3D34B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_15958ed48e32e749a2fbf9055438d26b_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_15958ed48e32e749a2fbf9055438d26b_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-10_15958ed48e32e749a2fbf9055438d26b_amadey_elex_redline-stealer_smoke-loader_stealc_stop
- Size 136KB
- SHA256 d753c61cb7b81ece0106d483fda4c59e26649dfcb32a942f9e300a871b527215
- MD5 15958ed48e32e749a2fbf9055438d26b
- SHA1 8f9bdc8c20f06c5e76ba6064070e4aa6808010ba
- SHA512 f7e47a13850254c0473debe47d921504f87e3a063180342c2309df82a1a5031c24fcd96a54c312154463970295d79432e053d3ba070ab8b9de0be5030a47e335
- SSDEEP 1536:46BCqjmug1b465/qUlkF3rHlTa2BEQqFkxDipTn5SA4TrRqwtsUUxtf9rtX5:n6dlQ3fEoyTn5SZTrRYzX5
- TLSH T1E2D39D107881C533C44ACA341419DB669E3E7A3126B89583F3991FFA5FB13E96A3D34B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.