General
- Target 2026-08-16_28485358b1b9d12559b265ce86c81557_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
- Size 21.5MB
- Sample260816-sd9hna1vbw
- SHA256 26acee2897ae0496eb141717df8870514f4c7724804b5021b46debf40ddae250
- MD5 28485358b1b9d12559b265ce86c81557
- SHA1 ea81a2cced1924963dea2275a25afc26181bc313
- SHA512 21fb8f63f35221f8fd848b8321487bb13f19ca8360f1ff859915d6fd0c5939be9d40230eadeae7d5cdfa4bcb2ef6d7af6f601c5dd1a0aeb0a178ffcfbb5ff257
- SSDEEP 393216:j3FREl5fKf+uyvI+7n53fEik40fmOEQXt+WH4JNpdTDlqf/R:j3FRcuyvvlMik40/+WkTDlop
- TLSH T11437336AE30190F0C8E587F041B60BA24F922D221FD1D9DF2BB9358DEED43E56B79509
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-16_28485358b1b9d12559b265ce86c81557_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-16_28485358b1b9d12559b265ce86c81557_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
- Size 21.5MB
- SHA256 26acee2897ae0496eb141717df8870514f4c7724804b5021b46debf40ddae250
- MD5 28485358b1b9d12559b265ce86c81557
- SHA1 ea81a2cced1924963dea2275a25afc26181bc313
- SHA512 21fb8f63f35221f8fd848b8321487bb13f19ca8360f1ff859915d6fd0c5939be9d40230eadeae7d5cdfa4bcb2ef6d7af6f601c5dd1a0aeb0a178ffcfbb5ff257
- SSDEEP 393216:j3FREl5fKf+uyvI+7n53fEik40fmOEQXt+WH4JNpdTDlqf/R:j3FRcuyvvlMik40/+WkTDlop
- TLSH T11437336AE30190F0C8E587F041B60BA24F922D221FD1D9DF2BB9358DEED43E56B79509
- MD5 SHA1 SHA512 SSDEEP TLSH
-
UPX dump on OEP (original entry point)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL