Extracted

• • Target
    2026-08-30_e9f006f97a7c15889f3f8002dcd2da57_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
  • Size 978KB
  • SHA256 0fad6e315ac98a53a9f5e389ce4e96260c5a7c731a0caef82e14d8784d984f81
  • MD5 e9f006f97a7c15889f3f8002dcd2da57
  • SHA1 5a722cd3e54f166212a604b28040af2ee3bb5432
  • SHA512 3e6abfda30bac7f50c6c2a973c844b9fc5dc573c76954b07aac19dda6df6ebee3e932e833005dde36b52dfd819f84fcf23e37ccc7d2ff4d95b6199c1a777d6ef
  • SSDEEP 3072:62+W363Nbv7kpZHJqBNcrAv6Lwh+CI6kkI9MsomUTVlowUTyY+DGSb36ESb/lqE5:6a6NzkPMTv6EhINqO
  • TLSH
    T1482591C98D143899F05E60B2A18B54EDE8C62F2D26A20B8163DCB0F59571BD3B3DC7D6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverysystembcsuricatatrojan

  • Family: SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc

  • Executes dropped EXE

  • Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound

    Network activity triggered a Suricata alert

    suricata

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Uses Tor communications

    Malware can proxy its traffic through Tor for more anonymity.

  behavioral1behavioral2