General
- Target 2026-08-11_a373445620c4f4c1c3e33a76317e7f22_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
- Size 72KB
- Sample260811-fryxvsstav
- SHA256 387e335b62d508ff42ad02a6df2a2c6671237a25422de907d61021e2e990e82a
- MD5 a373445620c4f4c1c3e33a76317e7f22
- SHA1 77eb9a2b5e5c2380385eeee2a237db3c74bfc157
- SHA512 e89f6732e570ed6f4d3f7ddac11c61a0dd47e1fd3422dbbcc8210c536d9cc1d43ce155711535a3e17f152c842cc2681e6d3d7d322052bcfbeb0ed882c75fe3dd
- SSDEEP 768:+00UHf57LnWykdBdusOAL/2DH9owR97k9/l4ElXYWFoHiPI6zDwiT6cBJhFd/B5U:+00URPnKfZrT2DawRR8JfP3DZB355B/i
- TLSH T162738E467881C4B2D80054B41826C6929F7FAD2257A5D0CBFB993E7E9F313DB893938D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-11_a373445620c4f4c1c3e33a76317e7f22_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-11_a373445620c4f4c1c3e33a76317e7f22_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-11_a373445620c4f4c1c3e33a76317e7f22_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
- Size 72KB
- SHA256 387e335b62d508ff42ad02a6df2a2c6671237a25422de907d61021e2e990e82a
- MD5 a373445620c4f4c1c3e33a76317e7f22
- SHA1 77eb9a2b5e5c2380385eeee2a237db3c74bfc157
- SHA512 e89f6732e570ed6f4d3f7ddac11c61a0dd47e1fd3422dbbcc8210c536d9cc1d43ce155711535a3e17f152c842cc2681e6d3d7d322052bcfbeb0ed882c75fe3dd
- SSDEEP 768:+00UHf57LnWykdBdusOAL/2DH9owR97k9/l4ElXYWFoHiPI6zDwiT6cBJhFd/B5U:+00URPnKfZrT2DawRR8JfP3DZB355B/i
- TLSH T162738E467881C4B2D80054B41826C6929F7FAD2257A5D0CBFB993E7E9F313DB893938D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory