General
- Target 2026-08-25_a8f7d57d16a4dcb12f0e545669e1bba5_amadey_elex_redline-stealer_smoke-loader_stealc_stop
- Size 123KB
- Sample260826-rjthysep2s
- SHA256 9b832e1e3d8e80105f440b9cc53e17c2df3efdd7fe6e29484e3fa131f6879847
- MD5 a8f7d57d16a4dcb12f0e545669e1bba5
- SHA1 3e224bbe181803fcf6a62f9443634ea88a875289
- SHA512 07179dea3a4819c751a4a5f3db8b20f91cac0116fdf15e3e5157648caec73fedef4cae139b71630b27601e00eea5100b7f397b5e99c0e6535b666fca0ad00901
- SSDEEP 1536:1XdnW4jHzGdaCnnNS49HlazjF/z4YqkZTYd/DZA4S0k59hwts1:XfwxlqfDY/DZACk59p1
- TLSH T15EC38D227942C17BC046A5301459D3619E3E39329678698BF3592FB99FB32D07A3D3CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-25_a8f7d57d16a4dcb12f0e545669e1bba5_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-25_a8f7d57d16a4dcb12f0e545669e1bba5_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-25_a8f7d57d16a4dcb12f0e545669e1bba5_amadey_elex_redline-stealer_smoke-loader_stealc_stop
- Size 123KB
- SHA256 9b832e1e3d8e80105f440b9cc53e17c2df3efdd7fe6e29484e3fa131f6879847
- MD5 a8f7d57d16a4dcb12f0e545669e1bba5
- SHA1 3e224bbe181803fcf6a62f9443634ea88a875289
- SHA512 07179dea3a4819c751a4a5f3db8b20f91cac0116fdf15e3e5157648caec73fedef4cae139b71630b27601e00eea5100b7f397b5e99c0e6535b666fca0ad00901
- SSDEEP 1536:1XdnW4jHzGdaCnnNS49HlazjF/z4YqkZTYd/DZA4S0k59hwts1:XfwxlqfDY/DZACk59p1
- TLSH T15EC38D227942C17BC046A5301459D3619E3E39329678698BF3592FB99FB32D07A3D3CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.