General
- Target 2026-08-13_0682e1751608f6d5e39b9b23bdfa6da2_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
- Size 9.8MB
- Sample260813-mvc8wsfp4y
- SHA256 1c38a3b97660ceb989e60e41139eb27f130c1dcae61f1b5132bc5f3c06c671de
- MD5 0682e1751608f6d5e39b9b23bdfa6da2
- SHA1 544f18a3a8f40cabdd8b072efcfdeface69cd9b5
- SHA512 c021719cf187100d166ff0ec1bd8d942afa77ab67e5e8352b1c12845d95d26250695e184e440020df2e03dadb7b18754891bdd37f657c751514c129de002924a
- SSDEEP 196608:O3F6n80W6uGTIx4OE03Wl6a5DM+kKT1TnP6d4QSjR/5B0QXygol9c5HQD:KFRExIZRIpDM+Vz9tBB0QCgoCo
- TLSH T181A633C2F683C0F1D9A504380A946EB18F3D7D3543BAC6E71FD865A8DE253D0E63964A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-13_0682e1751608f6d5e39b9b23bdfa6da2_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-13_0682e1751608f6d5e39b9b23bdfa6da2_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
- Size 9.8MB
- SHA256 1c38a3b97660ceb989e60e41139eb27f130c1dcae61f1b5132bc5f3c06c671de
- MD5 0682e1751608f6d5e39b9b23bdfa6da2
- SHA1 544f18a3a8f40cabdd8b072efcfdeface69cd9b5
- SHA512 c021719cf187100d166ff0ec1bd8d942afa77ab67e5e8352b1c12845d95d26250695e184e440020df2e03dadb7b18754891bdd37f657c751514c129de002924a
- SSDEEP 196608:O3F6n80W6uGTIx4OE03Wl6a5DM+kKT1TnP6d4QSjR/5B0QXygol9c5HQD:KFRExIZRIpDM+Vz9tBB0QCgoCo
- TLSH T181A633C2F683C0F1D9A504380A946EB18F3D7D3543BAC6E71FD865A8DE253D0E63964A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
UPX dump on OEP (original entry point)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL