General
- Target 2026-08-25_d6eea4f02dc643c75808c7e30924c631_amadey_elex_rhadamanthys_smoke-loader_stop_urelas
- Size 426KB
- Sample260826-hzsrxshr7y
- SHA256 53ac2b92818dd4c5d71a55df6f0c3b262733db0b10e03a69deea6ee870926512
- MD5 d6eea4f02dc643c75808c7e30924c631
- SHA1 54d80e8b18f51f6e6dc2b8bacc8eda896e79bfe5
- SHA512 e387a01f97e5de247dde171e32d5eb47280d69c9ea3df93ffce632b384721f4ecb46328d3b8b17a05e3c98aabf7d57c59c79dbda888eb049b6d2ea139e1dbc7e
- SSDEEP 6144:GzU7blKaP2iCWhWapKRaRXOkN4Swel6f3IsInOCg:oU7M5ijWh0XOW4sEfeOL
- TLSH T14294CF263580C436F72A07324406FAE40A65AC3E1AD5E54FFB787E7968311979B3B24F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-25_d6eea4f02dc643c75808c7e30924c631_amadey_elex_rhadamanthys_smoke-loader_stop_urelas.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.226
-
218.54.31.165
Targets
-
- Target 2026-08-25_d6eea4f02dc643c75808c7e30924c631_amadey_elex_rhadamanthys_smoke-loader_stop_urelas
- Size 426KB
- SHA256 53ac2b92818dd4c5d71a55df6f0c3b262733db0b10e03a69deea6ee870926512
- MD5 d6eea4f02dc643c75808c7e30924c631
- SHA1 54d80e8b18f51f6e6dc2b8bacc8eda896e79bfe5
- SHA512 e387a01f97e5de247dde171e32d5eb47280d69c9ea3df93ffce632b384721f4ecb46328d3b8b17a05e3c98aabf7d57c59c79dbda888eb049b6d2ea139e1dbc7e
- SSDEEP 6144:GzU7blKaP2iCWhWapKRaRXOkN4Swel6f3IsInOCg:oU7M5ijWh0XOW4sEfeOL
- TLSH T14294CF263580C436F72A07324406FAE40A65AC3E1AD5E54FFB787E7968311979B3B24F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE