General
- Target 2026-08-12_a7b2d977e43d5898db0c386f3e38fce2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
- Size 72KB
- Sample260813-armlyagq2t
- SHA256 c7c68bc0e5d2355a84a2da30d05ba96eb215049ef40942adbf0aef17f5a51758
- MD5 a7b2d977e43d5898db0c386f3e38fce2
- SHA1 e808b6fd09643ccf93de840b4891beb38310b917
- SHA512 3bbda48da5c769c51259dbfd460eca94b8160b2b629a5fe8ad3dbf134eb50682cc1f1c85beb8a44d319cc08ccb129a11a38d9eb8e1aaa190356c88226c85f2c8
- SSDEEP 768:+00UHf57LnWykdBdusOAL/2DH9owR97k9/l4ElXYWFoHiPI6zDwdT6cBJhFd/B5U:+00URPnKfZrT2DawRR8JfP3IZB355B/i
- TLSH T11D738D467881C4B2D80054B41426C6929F7FAD2257A5D0CBFB993E7E9F313DB893938D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-12_a7b2d977e43d5898db0c386f3e38fce2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-12_a7b2d977e43d5898db0c386f3e38fce2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-12_a7b2d977e43d5898db0c386f3e38fce2_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
- Size 72KB
- SHA256 c7c68bc0e5d2355a84a2da30d05ba96eb215049ef40942adbf0aef17f5a51758
- MD5 a7b2d977e43d5898db0c386f3e38fce2
- SHA1 e808b6fd09643ccf93de840b4891beb38310b917
- SHA512 3bbda48da5c769c51259dbfd460eca94b8160b2b629a5fe8ad3dbf134eb50682cc1f1c85beb8a44d319cc08ccb129a11a38d9eb8e1aaa190356c88226c85f2c8
- SSDEEP 768:+00UHf57LnWykdBdusOAL/2DH9owR97k9/l4ElXYWFoHiPI6zDwdT6cBJhFd/B5U:+00URPnKfZrT2DawRR8JfP3IZB355B/i
- TLSH T11D738D467881C4B2D80054B41426C6929F7FAD2257A5D0CBFB993E7E9F313DB893938D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory