General
- Target 2026-10-26_718bbbfdb4ba5c9e5b71a01b523f0c79_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 595KB
- Sample261027-r23vcady6v
- SHA256 c6b7bd27862f86e1fc40ce1e5ab9915cc37f5a439f9edadee784dc98b82a53c4
- MD5 718bbbfdb4ba5c9e5b71a01b523f0c79
- SHA1 b74c8986c9208b7f2bf376f0775941ad4139721a
- SHA512 8465f55280ea21eb3e0698d8eac3cf631d3903e9260ababc72b5363bb1f5081cf8f19b31235938f18bb611e122bbc8343ec1be90e20244538f8be7d4d094a96c
- SSDEEP 6144:8EK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdFU:8MpASIcWYx2U6hAJQnl
- TLSH T19CD494685828C8D6E795D534E82CEB1596F48CF17B8300ABB076F9FCD4B22D161AF50E
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-10-26_718bbbfdb4ba5c9e5b71a01b523f0c79_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-10-26_718bbbfdb4ba5c9e5b71a01b523f0c79_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 595KB
- SHA256 c6b7bd27862f86e1fc40ce1e5ab9915cc37f5a439f9edadee784dc98b82a53c4
- MD5 718bbbfdb4ba5c9e5b71a01b523f0c79
- SHA1 b74c8986c9208b7f2bf376f0775941ad4139721a
- SHA512 8465f55280ea21eb3e0698d8eac3cf631d3903e9260ababc72b5363bb1f5081cf8f19b31235938f18bb611e122bbc8343ec1be90e20244538f8be7d4d094a96c
- SSDEEP 6144:8EK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdFU:8MpASIcWYx2U6hAJQnl
- TLSH T19CD494685828C8D6E795D534E82CEB1596F48CF17B8300ABB076F9FCD4B22D161AF50E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE