cbbe04df630c0d00243662eb510836824da3c97f6f0b47764c6621e1576393ee

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-21_7509242933b138938873aec03cc4f4ba_amadey_cloudeye_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
Size 54.4MB
Sample260822-psttzathre
SHA256 cbbe04df630c0d00243662eb510836824da3c97f6f0b47764c6621e1576393ee
MD5 7509242933b138938873aec03cc4f4ba
SHA1 9625c055a1314146276a0cb3b0c6b4c6fd9aa4a1
SHA512 e11ff53fe7d2776b00b4d0e927cad281be2e8479ab294443bdd1df919393e3bcd98b909d8165900a38237ea6852ad89f881212cbf29fd0a967000b61d530da33
SSDEEP 1572864:v2Usennap8w7LLtxgKHTi+oYk0qQIr5ZVe:nsinap8wjTM1YZqbLI
TLSH
T111C73303DDB2D5FCF1260638C06793393B2A6D18466695DB4FC9B897BEF1283AD12631
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-21_7509242933b138938873aec03cc4f4ba_amadey_cloudeye_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
- Size 54.4MB
- SHA256 cbbe04df630c0d00243662eb510836824da3c97f6f0b47764c6621e1576393ee
- MD5 7509242933b138938873aec03cc4f4ba
- SHA1 9625c055a1314146276a0cb3b0c6b4c6fd9aa4a1
- SHA512 e11ff53fe7d2776b00b4d0e927cad281be2e8479ab294443bdd1df919393e3bcd98b909d8165900a38237ea6852ad89f881212cbf29fd0a967000b61d530da33
- SSDEEP 1572864:v2Usennap8w7LLtxgKHTi+oYk0qQIr5ZVe:nsinap8wjTM1YZqbLI
- TLSH
  T111C73303DDB2D5FCF1260638C06793393B2A6D18466695DB4FC9B897BEF1283AD12631
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

discovery upx
- UPX dump on OEP (original entry point)
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  $PLUGINSDIR/B
- Size 54.3MB
- SHA256 24dbc3e905bd6baaad8f0fdb88f50423f220175d7f056f8058ac1e4cd0a5ab50
- MD5 2d60a6bd2ffd5efee05e220bfb619227
- SHA1 4c6a312bd2793d099c6e6e27cce8a6c7c4c21006
- SHA512 bc88c0b5fe9fc6c7ff859979ca737253bbd3abc81c8f5f8dc63aed338ec9c8dcd6daae6e14919d824bca4b7b30d3b94f9b88edb0e8dc3277bf3985c5163ee9c7
- SSDEEP 1572864:M2Usennap8w7LLtxgKHTi+oYk0qQIr5ZVk:+sinap8wjTM1YZqbLS
- TLSH
  T181C73303DDB2D5FCF1270638C062522D3A2A6D28466B95DF4FC9B493BEF56C2AD12631
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

discovery upx
- UPX dump on OEP (original entry point)
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- TLSH
  T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/inetc.dll
- Size 20KB
- SHA256 5552bdde7e4113393f683ef501e4cc84dccc071bdc51391ea7fa3e7c1d49e4e8
- MD5 c498ae64b4971132bba676873978de1e
- SHA1 92e4009cd776b6c8616d8bffade7668ef3cb3c27
- SHA512 8e5ca35493f749a39ceae6796d2658ba10f7d8d9ceca45bb4365b338fabd1dfa9b9f92e33f50c91b0273e66adfbce4b98b09c15fd2473f8b214ed797462333d7
- SSDEEP 384:EVJOXQZkjhm+Np3aWgzxljzbbEUhU7ya4LtU0Ac9khYLMkIX0+GBty3S:EeXQcm+NpqWgzxljzfEUhUua4LtG
- TLSH
  T17E921A01AF5596F3D3A90930F569375386EAAE742530A48767F71FCD186A283FA34703
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

UPX dump on OEP (original entry point)

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

UPX packed file

UPX dump on OEP (original entry point)

Checks computer location settings

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8