General
- Target 2026-08-22_40f618268b307cb0c097a13c376e9ffc_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 595KB
- Sample260823-lef46svfqd
- SHA256 ceecc71947f6801fb5272288c3992598c5c3dfbaefdf87b4e2a70ca2c54046c2
- MD5 40f618268b307cb0c097a13c376e9ffc
- SHA1 d39c7899411f44ad80949922f572a9d7b297d308
- SHA512 afed8bd59237d3010520ef3ae7e9fca3bd8916a85c346a4d4b58ff58b2065e6faafb1143de509ac8ae982943f80aa5ce67142c40404a345965465a21eaaccbfc
- SSDEEP 6144:8EK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdFW:8MpASIcWYx2U6hAJQn7
- TLSH T1C8D494685828C8D6E795D534E82CEB1596F48CF17B8300ABB076F9FCD4B22D161AF50E
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-22_40f618268b307cb0c097a13c376e9ffc_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-08-22_40f618268b307cb0c097a13c376e9ffc_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 595KB
- SHA256 ceecc71947f6801fb5272288c3992598c5c3dfbaefdf87b4e2a70ca2c54046c2
- MD5 40f618268b307cb0c097a13c376e9ffc
- SHA1 d39c7899411f44ad80949922f572a9d7b297d308
- SHA512 afed8bd59237d3010520ef3ae7e9fca3bd8916a85c346a4d4b58ff58b2065e6faafb1143de509ac8ae982943f80aa5ce67142c40404a345965465a21eaaccbfc
- SSDEEP 6144:8EK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdFW:8MpASIcWYx2U6hAJQn7
- TLSH T1C8D494685828C8D6E795D534E82CEB1596F48CF17B8300ABB076F9FCD4B22D161AF50E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE