Extracted

• • Target
    2026-08-30_380319b0f4b11add86d791a87441ed4e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 1.1MB
  • SHA256 44ef83980f2f14ebf8e2e4b0deaff2725a47a57608fc4d3c595db3bfa1fb4d79
  • MD5 380319b0f4b11add86d791a87441ed4e
  • SHA1 a95fee443bb5f7bbed1fc8b8aec2a5af748284f1
  • SHA512 7a3268c1fd6a24e41516dab91b634f8c8e29beff08c0547cee572986e24580198c2d5d266c2a91986550a7d67f841351d1dd8d1fe37c00b6ef1b811fa24cad6a
  • SSDEEP 3072:XBNre6fpc/1GL4NgT1JinUVfHs52s6UZJWsJIaEdK4T1:xBfpc/1GLZTIUVfHsbW/dKw
  • TLSH
    T166455B0035D3C071D1A66575D825C6B84BA77CB2992259CF3ACA3BBE3F346D29E6430B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverysystembcsuricatatrojan

  • Family: SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc

  • Executes dropped EXE

  • Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound

    Network activity triggered a Suricata alert

    suricata

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Uses Tor communications

    Malware can proxy its traffic through Tor for more anonymity.

  behavioral1behavioral2