General
- Target 2026-10-16_f791c07c63ddd4f33b36dbf32c1d27e0_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 407KB
- Sample261017-cma4fsf14l
- SHA256 b27ddaa962bb1f65a66cc86fb498f971232c59f5a6f403a7c1d75f22880a4cbe
- MD5 f791c07c63ddd4f33b36dbf32c1d27e0
- SHA1 d30fcdd722e5ad9346bca90f4e59aa73e18e00af
- SHA512 84b340002b1c6dab564fdc610dedf89d125284ec3722f241eeb757abd6d2294d192056834c7ba2db95534829d0d8dbb8b3eff5039c6d45c9e94d249757d9b8ac
- SSDEEP 6144:Y5SXvBoDWoyLYyzbwOC4DYM6SB6v+qLnAzYmhwrxcvkzmSB7oht:YIfBoDWoyFbkU6hAJQnaH
- TLSH T19594BE253540C436F3290B354855EAB10AA9BC3914D9E48FF778BE7A6D321938B7B24F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-10-16_f791c07c63ddd4f33b36dbf32c1d27e0_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-10-16_f791c07c63ddd4f33b36dbf32c1d27e0_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 407KB
- SHA256 b27ddaa962bb1f65a66cc86fb498f971232c59f5a6f403a7c1d75f22880a4cbe
- MD5 f791c07c63ddd4f33b36dbf32c1d27e0
- SHA1 d30fcdd722e5ad9346bca90f4e59aa73e18e00af
- SHA512 84b340002b1c6dab564fdc610dedf89d125284ec3722f241eeb757abd6d2294d192056834c7ba2db95534829d0d8dbb8b3eff5039c6d45c9e94d249757d9b8ac
- SSDEEP 6144:Y5SXvBoDWoyLYyzbwOC4DYM6SB6v+qLnAzYmhwrxcvkzmSB7oht:YIfBoDWoyFbkU6hAJQnaH
- TLSH T19594BE253540C436F3290B354855EAB10AA9BC3914D9E48FF778BE7A6D321938B7B24F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE