General
- Target 2026-10-10_149ede98d1fa2be858688cb22ee37584_amadey_elex_redline-stealer_smoke-loader_stealc_stop
- Size 123KB
- Sample261011-zhcstagg27
- SHA256 6e0c4bcec86c05bfa8ede049741828d4af65fcb7b7f348bdc7669d67521105fa
- MD5 149ede98d1fa2be858688cb22ee37584
- SHA1 be7567ef160c671c1b60708fef264e66a1b4bea0
- SHA512 f94c6519f3dffac62bcb23aa82d37b01d6f85e8d3b62eeec768086e49581ebcc584490d529252e2c8f3b2fa5b96c059072f347e631169061864d1f24b69fb422
- SSDEEP 1536:yVYYRiu+5Acd1DlWlhJ3a9MqjBturIk31lFNdrioIlk5adwts3:CMuDlhURurt/NdrN4k5aF3
- TLSH T14EC37B217941C033C48AA5701719E372EA3D693166B99587F38D0FFA6EB03D0AA3D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-10_149ede98d1fa2be858688cb22ee37584_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-10_149ede98d1fa2be858688cb22ee37584_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-10_149ede98d1fa2be858688cb22ee37584_amadey_elex_redline-stealer_smoke-loader_stealc_stop
- Size 123KB
- SHA256 6e0c4bcec86c05bfa8ede049741828d4af65fcb7b7f348bdc7669d67521105fa
- MD5 149ede98d1fa2be858688cb22ee37584
- SHA1 be7567ef160c671c1b60708fef264e66a1b4bea0
- SHA512 f94c6519f3dffac62bcb23aa82d37b01d6f85e8d3b62eeec768086e49581ebcc584490d529252e2c8f3b2fa5b96c059072f347e631169061864d1f24b69fb422
- SSDEEP 1536:yVYYRiu+5Acd1DlWlhJ3a9MqjBturIk31lFNdrioIlk5adwts3:CMuDlhURurt/NdrN4k5aF3
- TLSH T14EC37B217941C033C48AA5701719E372EA3D693166B99587F38D0FFA6EB03D0AA3D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.