General
- Target 2026-10-26_a009f8182ecd8a4b2dde416baad22106_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee
- Size 445KB
- Sample261027-ml3gesdc45
- SHA256 12bbc666aefe5c209e8445ec97520ebd1f62c5ea55248a359587e63bb7960a9a
- MD5 a009f8182ecd8a4b2dde416baad22106
- SHA1 7ee78a5a2f28072feab128aed772ed9d6d35ca9b
- SHA512 b81d585af94c5d7270a3862a20dd9779d9d3e572e79c7edfec4c8756b43a38b0e96b4ed02d9ef08c456e79f4883eaf9587a8c3976fbbee6bde1ee20a772845d4
- SSDEEP 6144:oo3wBi+1Py3V0a2WkRNgi3caOHO5NjEwwiYWB5mV4Pzw9ygibGGMI26:rKf1PyKa2H3hOHOHz9JQ6zBn26
- TLSH T1ABA4BE2562808436F76A0B3049A5E6F50868BC392BA5E58FF378BD392D701D35A7335F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-10-26_a009f8182ecd8a4b2dde416baad22106_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
1.234.83.146
-
133.242.129.155
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-10-26_a009f8182ecd8a4b2dde416baad22106_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee
- Size 445KB
- SHA256 12bbc666aefe5c209e8445ec97520ebd1f62c5ea55248a359587e63bb7960a9a
- MD5 a009f8182ecd8a4b2dde416baad22106
- SHA1 7ee78a5a2f28072feab128aed772ed9d6d35ca9b
- SHA512 b81d585af94c5d7270a3862a20dd9779d9d3e572e79c7edfec4c8756b43a38b0e96b4ed02d9ef08c456e79f4883eaf9587a8c3976fbbee6bde1ee20a772845d4
- SSDEEP 6144:oo3wBi+1Py3V0a2WkRNgi3caOHO5NjEwwiYWB5mV4Pzw9ygibGGMI26:rKf1PyKa2H3hOHOHz9JQ6zBn26
- TLSH T1ABA4BE2562808436F76A0B3049A5E6F50868BC392BA5E58FF378BD392D701D35A7335F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE