General
- Target 2026-08-23_ef6af0095120c985472c0dd44484df47_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
- Size 36.9MB
- Sample260823-tmxe5aszes
- SHA256 55054e3fa6d47a1d5c65057a4f38f1e70758a877c51589d3070ddf202d6aea43
- MD5 ef6af0095120c985472c0dd44484df47
- SHA1 fc24d7f75671dcdbc50dadb0f9cbf1fea03510e6
- SHA512 80bb6c7c4fc9718c31e30c89d5811032c5e54910af15633fd38c69d8c65f5e27f260ddfaa110b60ed1284851f71f03c332017aa6a8370754be5569eae56f8a94
- SSDEEP 786432:kVOcFRSBByBd9yOQGBR9hFyEeCFbIHpSdDBr2t0XOCLxItl+3v9TFMXozhQ045/V:LBBUdzHdyEeCRIHcdD+KOCtI/+N+i74v
- TLSH T12A873358AF4580E5F4A630388EC68F5927E91D30BAABDEF366C37815CF78D917DA2005
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-23_ef6af0095120c985472c0dd44484df47_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-23_ef6af0095120c985472c0dd44484df47_amadey_elex_karagany_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
- Size 36.9MB
- SHA256 55054e3fa6d47a1d5c65057a4f38f1e70758a877c51589d3070ddf202d6aea43
- MD5 ef6af0095120c985472c0dd44484df47
- SHA1 fc24d7f75671dcdbc50dadb0f9cbf1fea03510e6
- SHA512 80bb6c7c4fc9718c31e30c89d5811032c5e54910af15633fd38c69d8c65f5e27f260ddfaa110b60ed1284851f71f03c332017aa6a8370754be5569eae56f8a94
- SSDEEP 786432:kVOcFRSBByBd9yOQGBR9hFyEeCFbIHpSdDBr2t0XOCLxItl+3v9TFMXozhQ045/V:LBBUdzHdyEeCRIHcdD+KOCtI/+N+i74v
- TLSH T12A873358AF4580E5F4A630388EC68F5927E91D30BAABDEF366C37815CF78D917DA2005
- MD5 SHA1 SHA512 SSDEEP TLSH
-
UPX dump on OEP (original entry point)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL