General
- Target 2026-08-18_f5097d31ca89a8bf80552ab50161fac0_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 410KB
- Sample260818-txc48sdp7z
- SHA256 ec025caf057efb3d5ed6f3dbdbdaf95c43a8f9df2f6a4bfbf4019fb5c8a38c64
- MD5 f5097d31ca89a8bf80552ab50161fac0
- SHA1 5dca7cbc66f6e78dcbce866b2fb6f33d0e555b89
- SHA512 a73304e4a092db2e687e09cfdd02155cd51a7942514f59d58b0fbd48eb598998412d4e0f2d8fae82de725a314876695d5dff4f172f72b60f756e740e3fe95ae8
- SSDEEP 6144:Y5SXvBoDWoyLYyzbwOC4DYM6SB6v+qLnAzYmhwrxcvkzmSB7ohVY:YIfBoDWoyFbkU6hAJQna0
- TLSH T19094BD253540C436F3290B354855EAB10AA9BC3A14D9E48FF7787E7A6D321938B7B24F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-18_f5097d31ca89a8bf80552ab50161fac0_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-08-18_f5097d31ca89a8bf80552ab50161fac0_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 410KB
- SHA256 ec025caf057efb3d5ed6f3dbdbdaf95c43a8f9df2f6a4bfbf4019fb5c8a38c64
- MD5 f5097d31ca89a8bf80552ab50161fac0
- SHA1 5dca7cbc66f6e78dcbce866b2fb6f33d0e555b89
- SHA512 a73304e4a092db2e687e09cfdd02155cd51a7942514f59d58b0fbd48eb598998412d4e0f2d8fae82de725a314876695d5dff4f172f72b60f756e740e3fe95ae8
- SSDEEP 6144:Y5SXvBoDWoyLYyzbwOC4DYM6SB6v+qLnAzYmhwrxcvkzmSB7ohVY:YIfBoDWoyFbkU6hAJQna0
- TLSH T19094BD253540C436F3290B354855EAB10AA9BC3A14D9E48FF7787E7A6D321938B7B24F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE