General
- Target 2026-08-20_751b733e6c061ad7be474b743388c6f7_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee
- Size 441KB
- Sample260820-pm2bvsck8t
- SHA256 263b886d86fd0987633b19bcec693c3214c85753e5a04cf90726262dc108edf8
- MD5 751b733e6c061ad7be474b743388c6f7
- SHA1 76d2146f3ea678b0a4218c7a9c15b2c098f87d28
- SHA512 6190385471a63c967976efe794dd5eae3e0e324a9c3581bd67c37f06c2e6d437dc751b6e35306e80a6494fefc27b74de6c539d16f0d71c7c9519c6b5dc4288b4
- SSDEEP 6144:oo3wBi+1Py3V0a2WkRNgi3caOHO5NjEwwiYWB5mV4Pzw9ygibGG/K:rKf1PyKa2H3hOHOHz9JQ6zBI
- TLSH T128A4AE2572808435F76A0B3049A5E6F508A8BC392BA5E58FF368BD392D701D35A7335F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-20_751b733e6c061ad7be474b743388c6f7_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
1.234.83.146
-
133.242.129.155
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-08-20_751b733e6c061ad7be474b743388c6f7_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee
- Size 441KB
- SHA256 263b886d86fd0987633b19bcec693c3214c85753e5a04cf90726262dc108edf8
- MD5 751b733e6c061ad7be474b743388c6f7
- SHA1 76d2146f3ea678b0a4218c7a9c15b2c098f87d28
- SHA512 6190385471a63c967976efe794dd5eae3e0e324a9c3581bd67c37f06c2e6d437dc751b6e35306e80a6494fefc27b74de6c539d16f0d71c7c9519c6b5dc4288b4
- SSDEEP 6144:oo3wBi+1Py3V0a2WkRNgi3caOHO5NjEwwiYWB5mV4Pzw9ygibGG/K:rKf1PyKa2H3hOHOHz9JQ6zBI
- TLSH T128A4AE2572808435F76A0B3049A5E6F508A8BC392BA5E58FF368BD392D701D35A7335F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE