General
- Target 2026-08-14_3c6b1fdd7910683a903a517cf74498b3_elex_karagany_redline-stealer_rhadamanthys_rifdoor_smoke-loader_stealc
- Size 80KB
- Sample260814-tjjd4aaf96
- SHA256 84577d6bd837bd4b171b59e6e6c325a1a442ceb9fb0914f3325093289b34c110
- MD5 3c6b1fdd7910683a903a517cf74498b3
- SHA1 0a0986ef8fabc96bbfb4e18baf48932a91535dd6
- SHA512 2611cbb369e9331a88af7cd035d3ff7bc2c4e01149d1f56248f40dc2da79b16dd3336fba75c3fc95b852e1539870b5f9ed159f5aaa2bf3528cb47b8fa9749dec
- SSDEEP 1536:RLNIP9SaZTbFARlq7jC1OZstZu0TS3lEdUJrkb00wJjZs:RL+ZTZX3BAtTS3lEdUJrkb0nls
- TLSH T15D838D117280C473E0A2143144BAD7B25ABEBC3366F999877B9417FE5E703D1AA39327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-14_3c6b1fdd7910683a903a517cf74498b3_elex_karagany_redline-stealer_rhadamanthys_rifdoor_smoke-loader_stealc.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-14_3c6b1fdd7910683a903a517cf74498b3_elex_karagany_redline-stealer_rhadamanthys_rifdoor_smoke-loader_stealc.exe
Resource
win11ltsc2024-20260710-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-14_3c6b1fdd7910683a903a517cf74498b3_elex_karagany_redline-stealer_rhadamanthys_rifdoor_smoke-loader_stealc
- Size 80KB
- SHA256 84577d6bd837bd4b171b59e6e6c325a1a442ceb9fb0914f3325093289b34c110
- MD5 3c6b1fdd7910683a903a517cf74498b3
- SHA1 0a0986ef8fabc96bbfb4e18baf48932a91535dd6
- SHA512 2611cbb369e9331a88af7cd035d3ff7bc2c4e01149d1f56248f40dc2da79b16dd3336fba75c3fc95b852e1539870b5f9ed159f5aaa2bf3528cb47b8fa9749dec
- SSDEEP 1536:RLNIP9SaZTbFARlq7jC1OZstZu0TS3lEdUJrkb00wJjZs:RL+ZTZX3BAtTS3lEdUJrkb0nls
- TLSH T15D838D117280C473E0A2143144BAD7B25ABEBC3366F999877B9417FE5E703D1AA39327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.