General
- Target 2026-08-19_acb3f9249c7655cc59540c6d8e53cf80_elex_karagany_redline-stealer_rhadamanthys_rifdoor_smoke-loader_stealc
- Size 80KB
- Sample260819-16m45axvft
- SHA256 b1cdf1c2d759707e87745d2261a3de7999bdc7e6b24e2dfeacea1b0ce9ccafcc
- MD5 acb3f9249c7655cc59540c6d8e53cf80
- SHA1 341d7345b2aa56a6999da2fcc3bc190344ca206d
- SHA512 8f4ab8f609ad7340e5b1f379e4fdb2b871a16353f7df53901aac1f7ac1c5e141d1bc3e9ccc02f9005cc63c8fb87edfb1e0bea911d9a5586704cf72badff78af4
- SSDEEP 1536:RLNIP9SaZTbFARlq7jC1OZstZu0TS3lEdUJrkb00wJjZj:RL+ZTZX3BAtTS3lEdUJrkb0nlj
- TLSH T135838D117280C473E0A2143144BAD7B24ABEBC3366F999877B9417FE5E703D1AA39367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_acb3f9249c7655cc59540c6d8e53cf80_elex_karagany_redline-stealer_rhadamanthys_rifdoor_smoke-loader_stealc.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_acb3f9249c7655cc59540c6d8e53cf80_elex_karagany_redline-stealer_rhadamanthys_rifdoor_smoke-loader_stealc.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-19_acb3f9249c7655cc59540c6d8e53cf80_elex_karagany_redline-stealer_rhadamanthys_rifdoor_smoke-loader_stealc
- Size 80KB
- SHA256 b1cdf1c2d759707e87745d2261a3de7999bdc7e6b24e2dfeacea1b0ce9ccafcc
- MD5 acb3f9249c7655cc59540c6d8e53cf80
- SHA1 341d7345b2aa56a6999da2fcc3bc190344ca206d
- SHA512 8f4ab8f609ad7340e5b1f379e4fdb2b871a16353f7df53901aac1f7ac1c5e141d1bc3e9ccc02f9005cc63c8fb87edfb1e0bea911d9a5586704cf72badff78af4
- SSDEEP 1536:RLNIP9SaZTbFARlq7jC1OZstZu0TS3lEdUJrkb00wJjZj:RL+ZTZX3BAtTS3lEdUJrkb0nlj
- TLSH T135838D117280C473E0A2143144BAD7B24ABEBC3366F999877B9417FE5E703D1AA39367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.