General
- Target 2026-08-20_8ecdc4b259b4cbb5147be2c1e7284f97_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee
- Size 445KB
- Sample260820-gd7taaer71
- SHA256 bd98b6800249d07bc7590c8f46680003a68370348b65be39f501e60296329091
- MD5 8ecdc4b259b4cbb5147be2c1e7284f97
- SHA1 d8a00dddad8144468fdd8e46f73dbc70e48b5735
- SHA512 bd5a118b48fdb64dd63ddfcac11b4e3243e3f1f155a7ef082c1e8e6245159d32b59c843c74b4a2512955cae2f09448b71d92ab642ef3bf36461b9a1858250be1
- SSDEEP 6144:oo3wBi+1Py3V0a2WkRNgi3caOHO5NjEwwiYWB5mV4Pzw9ygibGGMm:rKf1PyKa2H3hOHOHz9JQ6zB9
- TLSH T10AA4AE2572808436F76A0B3049A5E6F50868AC392BA5E58FF378BD392D701D35A7335F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-20_8ecdc4b259b4cbb5147be2c1e7284f97_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
1.234.83.146
-
133.242.129.155
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-08-20_8ecdc4b259b4cbb5147be2c1e7284f97_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee
- Size 445KB
- SHA256 bd98b6800249d07bc7590c8f46680003a68370348b65be39f501e60296329091
- MD5 8ecdc4b259b4cbb5147be2c1e7284f97
- SHA1 d8a00dddad8144468fdd8e46f73dbc70e48b5735
- SHA512 bd5a118b48fdb64dd63ddfcac11b4e3243e3f1f155a7ef082c1e8e6245159d32b59c843c74b4a2512955cae2f09448b71d92ab642ef3bf36461b9a1858250be1
- SSDEEP 6144:oo3wBi+1Py3V0a2WkRNgi3caOHO5NjEwwiYWB5mV4Pzw9ygibGGMm:rKf1PyKa2H3hOHOHz9JQ6zB9
- TLSH T10AA4AE2572808436F76A0B3049A5E6F50868AC392BA5E58FF378BD392D701D35A7335F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE