General
- Target 2026-10-22_67c01eca2b1b8dbbfa0dcd0df81ed5c9_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 420KB
- Sample261024-mecmesa16n
- SHA256 df0b32226575dad07f825461f7a89faa3bbb7c0224710c5a5696a231587f6e6f
- MD5 67c01eca2b1b8dbbfa0dcd0df81ed5c9
- SHA1 97d68b74ad40459acb9ba2a89f57c8ede208521b
- SHA512 76e0b93edce34f59c64486b23fdc695fe383b3da88c2bcd97a321faa31337d0e918107f350e98f4c4101d6e24c61bee39cf75182a7167376f4682e0ae0d7c3cd
- SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBw/iWj:yIfBoDWoyFboU6hAJQnrM7
- TLSH T12E94BE253640C436F32A0B364456FAA04969BC3A15D5E48FF7787E7A5D312938B3B28F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-10-22_67c01eca2b1b8dbbfa0dcd0df81ed5c9_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-10-22_67c01eca2b1b8dbbfa0dcd0df81ed5c9_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 420KB
- SHA256 df0b32226575dad07f825461f7a89faa3bbb7c0224710c5a5696a231587f6e6f
- MD5 67c01eca2b1b8dbbfa0dcd0df81ed5c9
- SHA1 97d68b74ad40459acb9ba2a89f57c8ede208521b
- SHA512 76e0b93edce34f59c64486b23fdc695fe383b3da88c2bcd97a321faa31337d0e918107f350e98f4c4101d6e24c61bee39cf75182a7167376f4682e0ae0d7c3cd
- SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBw/iWj:yIfBoDWoyFboU6hAJQnrM7
- TLSH T12E94BE253640C436F32A0B364456FAA04969BC3A15D5E48FF7787E7A5D312938B3B28F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE