General
- Target 2026-08-18_6e6a27d50759250a9c32ba0f85b7a4f8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 595KB
- Sample260818-3ll3fasgqd
- SHA256 122a328428bc89ac33a781f98bc38d14f0b41ee158037d646032972b7b1cfe94
- MD5 6e6a27d50759250a9c32ba0f85b7a4f8
- SHA1 21b380ba6cc6e0bedf5be5bdd97a90ea78c914e8
- SHA512 1558a594402c49c57fc8454af617523589d756b6e9dd1b40cf5a6a9ff4a44f2638396bb05dba46e364f65b65ba53a75a665b417809b433b91988a2b1080258f3
- SSDEEP 6144:8EK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdFO:8MpASIcWYx2U6hAJQnl
- TLSH T1A1D494685828C8D6E795D534E82CEB1596F48CF17B8300ABB076F9FCD4B22D161AF50E
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-18_6e6a27d50759250a9c32ba0f85b7a4f8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-08-18_6e6a27d50759250a9c32ba0f85b7a4f8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 595KB
- SHA256 122a328428bc89ac33a781f98bc38d14f0b41ee158037d646032972b7b1cfe94
- MD5 6e6a27d50759250a9c32ba0f85b7a4f8
- SHA1 21b380ba6cc6e0bedf5be5bdd97a90ea78c914e8
- SHA512 1558a594402c49c57fc8454af617523589d756b6e9dd1b40cf5a6a9ff4a44f2638396bb05dba46e364f65b65ba53a75a665b417809b433b91988a2b1080258f3
- SSDEEP 6144:8EK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdFO:8MpASIcWYx2U6hAJQnl
- TLSH T1A1D494685828C8D6E795D534E82CEB1596F48CF17B8300ABB076F9FCD4B22D161AF50E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE