General
- Target 2026-10-09_ffc7df92836cc96e3b9f719fce335c22_amadey_elex_redline-stealer_smoke-loader_stealc_stop
- Size 123KB
- Sample261009-2zhfqsxt5r
- SHA256 27c02400a2d753da937f753fc194d77b5c77a1c98a4ffa67950f55da63a5c470
- MD5 ffc7df92836cc96e3b9f719fce335c22
- SHA1 729ad0f6d65ce10de9c02bea29a8a02a996e1bf1
- SHA512 a5f00dd0cdd1c135e9e2666ef4e02cd519ab57e2fe8211f75bcb2f7629ff394748d52d0af9935381d4ac8cd37a7f604ebf78d8a0f9096805e469981c602595c2
- SSDEEP 1536:yVYYRiu+5Acd1DlWlhJ3a9MqjBturIk31lFNdrioIlk5adwtsB:CMuDlhURurt/NdrN4k5aFB
- TLSH T1D5C37B217941C033C08AA5701719E372EA7D693166B95587F39D0BFA6EB03D0BA3D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-09_ffc7df92836cc96e3b9f719fce335c22_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-09_ffc7df92836cc96e3b9f719fce335c22_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-09_ffc7df92836cc96e3b9f719fce335c22_amadey_elex_redline-stealer_smoke-loader_stealc_stop
- Size 123KB
- SHA256 27c02400a2d753da937f753fc194d77b5c77a1c98a4ffa67950f55da63a5c470
- MD5 ffc7df92836cc96e3b9f719fce335c22
- SHA1 729ad0f6d65ce10de9c02bea29a8a02a996e1bf1
- SHA512 a5f00dd0cdd1c135e9e2666ef4e02cd519ab57e2fe8211f75bcb2f7629ff394748d52d0af9935381d4ac8cd37a7f604ebf78d8a0f9096805e469981c602595c2
- SSDEEP 1536:yVYYRiu+5Acd1DlWlhJ3a9MqjBturIk31lFNdrioIlk5adwtsB:CMuDlhURurt/NdrN4k5aFB
- TLSH T1D5C37B217941C033C08AA5701719E372EA7D693166B95587F39D0BFA6EB03D0BA3D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.