General
- Target 2026-10-16_39472540a5994a67afa1630b443e8bda_amadey_elex_redline-stealer_smoke-loader_stealc_stop
- Size 123KB
- Sample261017-yk763av13l
- SHA256 a976bcbb55d93626e34baf9a9e167d68c748c46ebfb0fe75f42481de954ed799
- MD5 39472540a5994a67afa1630b443e8bda
- SHA1 f80d246c5f01b056edf421bdd919b12e05ea6c25
- SHA512 f6dad117a44ff34dac0769d2ab3845f7aaace4a26c66ff66d793ce6890ef9bb3f72f066844d82fa7b6c5913d250ea8bcaafa9377634f51c8bad9fd55bc61e7b2
- SSDEEP 1536:yVYYRiu+5Acd1DlWlhJ3a9MqjBturIk31lFNdrioIlk5adwtsf:CMuDlhURurt/NdrN4k5aFf
- TLSH T179C37B217941C033C08AA5701719E372EA7D693166B95587F39D0BFA6EB03D0BA3D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-16_39472540a5994a67afa1630b443e8bda_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-16_39472540a5994a67afa1630b443e8bda_amadey_elex_redline-stealer_smoke-loader_stealc_stop.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-16_39472540a5994a67afa1630b443e8bda_amadey_elex_redline-stealer_smoke-loader_stealc_stop
- Size 123KB
- SHA256 a976bcbb55d93626e34baf9a9e167d68c748c46ebfb0fe75f42481de954ed799
- MD5 39472540a5994a67afa1630b443e8bda
- SHA1 f80d246c5f01b056edf421bdd919b12e05ea6c25
- SHA512 f6dad117a44ff34dac0769d2ab3845f7aaace4a26c66ff66d793ce6890ef9bb3f72f066844d82fa7b6c5913d250ea8bcaafa9377634f51c8bad9fd55bc61e7b2
- SSDEEP 1536:yVYYRiu+5Acd1DlWlhJ3a9MqjBturIk31lFNdrioIlk5adwtsf:CMuDlhURurt/NdrN4k5aFf
- TLSH T179C37B217941C033C08AA5701719E372EA7D693166B95587F39D0BFA6EB03D0BA3D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Adds Run key to start application
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.