Extracted

• • Target
    2026-08-21_c9869b418847fd0dece6646041afc410_amadey_elex_rhadamanthys_smoke-loader_stealc_stop
  • Size 93KB
  • SHA256 3f7e392f2862a2fa6bc59ff6f588818ea59805b5edde8136aa2af88e7439ab32
  • MD5 c9869b418847fd0dece6646041afc410
  • SHA1 4368361bca665451e9f1991d57fe5a74e394f65d
  • SHA512 5d1b95e796c1f838d56f5dc311062739841c786f71c0d2e227fa4c477a8a8edd20604de1527cb418cb33327af1babd13c4f72de377fdfcb8b03e3928e08ab855
  • SSDEEP 1536:9s6LfQJWjijaDJ3VDnLYJZ9Rr4HzUa6h8AuqK67RVVmopbpGqr92F:PLQWyaxLYJRrgz2S67RuoNp5r4
  • TLSH
    T15093C02235C0C033C6A696755879CAA65FB9F4312AA6068F777C06BF5F603C1467B38E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverysystembcsuricatatrojan

  • Family: SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc

  • Executes dropped EXE

  • Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound

    Network activity triggered a Suricata alert

    suricata

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Uses Tor communications

    Malware can proxy its traffic through Tor for more anonymity.

  behavioral1behavioral2