General
- Target 2026-09-04_1cb6e0d6a35956ed27c11c614fba50ca_amadey_elex_rhadamanthys_smoke-loader_stop
- Size 353KB
- Sample260905-vks6csfl5w
- SHA256 d2e33c148268ea0387328f22c69b50fa2ce7525485c16c248c5060d438e7cd2c
- MD5 1cb6e0d6a35956ed27c11c614fba50ca
- SHA1 3f9f7313d3a43cd7de5afb700a0a7a331c98961e
- SHA512 38daa9a12cddeddbd7441f7cc9777f08e639e9840a99d9b21af8444acb30ff4dbcb72bb80141f74ef2f002de0b5563365624c0305928f0abc383b3e16c70497f
- SSDEEP 3072:wdXi+V5Kgxpdxj8gbib20xTyst542t8ZHWBow8+zoB91wDKCZS:wd7rpL43btmQ58Z27zw3eZS
- TLSH T113749D253580C475F32A07314446EAF00A65BC391A99E58FFBB8BD79AD311978B3B24F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-09-04_1cb6e0d6a35956ed27c11c614fba50ca_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-09-04_1cb6e0d6a35956ed27c11c614fba50ca_amadey_elex_rhadamanthys_smoke-loader_stop
- Size 353KB
- SHA256 d2e33c148268ea0387328f22c69b50fa2ce7525485c16c248c5060d438e7cd2c
- MD5 1cb6e0d6a35956ed27c11c614fba50ca
- SHA1 3f9f7313d3a43cd7de5afb700a0a7a331c98961e
- SHA512 38daa9a12cddeddbd7441f7cc9777f08e639e9840a99d9b21af8444acb30ff4dbcb72bb80141f74ef2f002de0b5563365624c0305928f0abc383b3e16c70497f
- SSDEEP 3072:wdXi+V5Kgxpdxj8gbib20xTyst542t8ZHWBow8+zoB91wDKCZS:wd7rpL43btmQ58Z27zw3eZS
- TLSH T113749D253580C475F32A07314446EAF00A65BC391A99E58FFBB8BD79AD311978B3B24F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE