General
- Target 2026-08-22_f1a38eaf8239cc84a9e7e77f89de8e80_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee
- Size 441KB
- Sample260822-1b5qpack3y
- SHA256 85f3b4a92490188dfad9d08f007c9148f9a6734ad3ddd5da2ac666d7e64bcb4e
- MD5 f1a38eaf8239cc84a9e7e77f89de8e80
- SHA1 b93c5af5e6211291aa646c23ac5beb449e66ddee
- SHA512 64b03f91d0f38afeb34df9a119ad7c06e6b80edc6a42b08cb274dbef78cacddd6381cea4ed485aef203be5257223d59a9ec3a0571a0c5e9a68d34cc7238527ff
- SSDEEP 6144:oo3wBi+1Py3V0a2WkRNgi3caOHO5NjEwwiYWB5mV4Pzw9ygibGG/G:rKf1PyKa2H3hOHOHz9JQ6zBU
- TLSH T14EA4AE2572808435F76A0B3049A5E6E50868BC392BA9E58FF378BD392D701D35A7335F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-22_f1a38eaf8239cc84a9e7e77f89de8e80_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
1.234.83.146
-
133.242.129.155
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-08-22_f1a38eaf8239cc84a9e7e77f89de8e80_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee
- Size 441KB
- SHA256 85f3b4a92490188dfad9d08f007c9148f9a6734ad3ddd5da2ac666d7e64bcb4e
- MD5 f1a38eaf8239cc84a9e7e77f89de8e80
- SHA1 b93c5af5e6211291aa646c23ac5beb449e66ddee
- SHA512 64b03f91d0f38afeb34df9a119ad7c06e6b80edc6a42b08cb274dbef78cacddd6381cea4ed485aef203be5257223d59a9ec3a0571a0c5e9a68d34cc7238527ff
- SSDEEP 6144:oo3wBi+1Py3V0a2WkRNgi3caOHO5NjEwwiYWB5mV4Pzw9ygibGG/G:rKf1PyKa2H3hOHOHz9JQ6zBU
- TLSH T14EA4AE2572808435F76A0B3049A5E6E50868BC392BA9E58FF378BD392D701D35A7335F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE