General
- Target 2026-10-17_1ef6733b7ebe8df6b05b928662102619_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 596KB
- Sample261019-lfggbstsdx
- SHA256 8daadd531533129485ffb64d28aa338e3ad24c3e935afd9b810d4e4100ec9fcc
- MD5 1ef6733b7ebe8df6b05b928662102619
- SHA1 5b9f2c901f91abc7a52dc9a2b7e87ff711d80052
- SHA512 592931f10c8ae5dea09ec28622c39651935d14d955b0aa934e03a66b73450306c2fe5ac058e4f072f54eb3ecf68e717f29f8af0f9e45f22fcee54857295e5d7d
- SSDEEP 6144:8EK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdFPv:8MpASIcWYx2U6hAJQnwv
- TLSH T1C3D494685828C8D6E795D534E82CEB1596F48CF17B8300ABB076F9FCD4B22D161AF50E
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-10-17_1ef6733b7ebe8df6b05b928662102619_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-10-17_1ef6733b7ebe8df6b05b928662102619_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 596KB
- SHA256 8daadd531533129485ffb64d28aa338e3ad24c3e935afd9b810d4e4100ec9fcc
- MD5 1ef6733b7ebe8df6b05b928662102619
- SHA1 5b9f2c901f91abc7a52dc9a2b7e87ff711d80052
- SHA512 592931f10c8ae5dea09ec28622c39651935d14d955b0aa934e03a66b73450306c2fe5ac058e4f072f54eb3ecf68e717f29f8af0f9e45f22fcee54857295e5d7d
- SSDEEP 6144:8EK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdFPv:8MpASIcWYx2U6hAJQnwv
- TLSH T1C3D494685828C8D6E795D534E82CEB1596F48CF17B8300ABB076F9FCD4B22D161AF50E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE