General
- Target 2026-10-10_c5b18128e942f0f95b182f563fdcfc2c_amadey_elex_rhadamanthys_smoke-loader_stop_urelas
- Size 425KB
- Sample261011-dc2n4ac18j
- SHA256 3b7042a152baac78ca4df5bea49ce21e36088071efaa1c7c902db854cba41814
- MD5 c5b18128e942f0f95b182f563fdcfc2c
- SHA1 6c54dc65085bcf162b4dab061b2ff0894b9779fe
- SHA512 a23421885c36945ecbc0ebbf92a3f8665ffe3b1318ed2c541141f200abfd0571eb54a432f696309df3965fe72de2672148665bc440d22696242cf1aebdf7ba08
- SSDEEP 6144:GzU7blKaP2iCWhWapKRaRXOkN4Swel6f3IsInOCL:oU7M5ijWh0XOW4sEfeO4
- TLSH T16194DF263580C436F72907324406FAE40A65AC3E1AD5E54FFBB87E7968311979B3B24F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-10-10_c5b18128e942f0f95b182f563fdcfc2c_amadey_elex_rhadamanthys_smoke-loader_stop_urelas.exe
Resource
win10v2004-20260911-en
10 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.226
-
218.54.31.165
Targets
-
- Target 2026-10-10_c5b18128e942f0f95b182f563fdcfc2c_amadey_elex_rhadamanthys_smoke-loader_stop_urelas
- Size 425KB
- SHA256 3b7042a152baac78ca4df5bea49ce21e36088071efaa1c7c902db854cba41814
- MD5 c5b18128e942f0f95b182f563fdcfc2c
- SHA1 6c54dc65085bcf162b4dab061b2ff0894b9779fe
- SHA512 a23421885c36945ecbc0ebbf92a3f8665ffe3b1318ed2c541141f200abfd0571eb54a432f696309df3965fe72de2672148665bc440d22696242cf1aebdf7ba08
- SSDEEP 6144:GzU7blKaP2iCWhWapKRaRXOkN4Swel6f3IsInOCL:oU7M5ijWh0XOW4sEfeO4
- TLSH T16194DF263580C436F72907324406FAE40A65AC3E1AD5E54FFBB87E7968311979B3B24F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE